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Preface 


This book is a collection of essays on the management of technological risk. This is a subject commonly associated 
with engineers and scientists, but our perspective is that of managers. That is, we take the viewpoint of those in 
business, government or the non-profit sector who must deal with the administrative, regulatory and managerial 
issues that are raised by human activities and products — technologies. Furthermore, while managers are frequently 
concerned with money, we also underline our work with ethical and moral principles. We invite your interest and 
your comments. The subject is one that is ongoing. 
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Dr John C. Nash obtained his B.Sc. from the University of Calgary (in Chemistry) and his doctorate in Mathematics 
from Oxford. He was in charge of a statistical analysis unit for Agriculture Canada until 1980, and is now Full 
Professor in the Faculty of Administration of the University of Ottawa. He is a frequent invited speaker on topics 
related to statistical computing, microcomputer applications, and risk management. At the University of Ottawa, he 
teaches statistics for management, forecasting techniques and managing technological risk. 

Dr. Nash is the author of three books on computation — Compact numerical methods for computers (Adam Hilger: 
Bristol and American Institute of Physics, New York, 1979 and Second Edition with software diskette 1990), 
Nonlinear parameter estimation: an integrated system in BASIC (Dekker: New York, 1987), and Effective scientific 
problem solving with small computers (Reston: Virginia, 1984). The last work was completely rewritten (with Mary 
Nash) and published as an electronic monograph in 1995 as Scientific Computing with PCs. His research and 
popular writings cover a wide range of topics in management, risk, statistics, computers, mathematics and 
information science. He has been mathematics columnist for Interface Age, Scientific Computing editor for Byte 
magazine, and occasional columnist in Chance (on managing risk), PC Magazine and The Lancet. He was Editor 
and Managing Editor of SSC Liaison for the Statistical Society of Canada from 1991-1994 and an Associate Editor 
of The American Statistician from 1991-1997. 

Mary> Nash has wide-ranging experience in the library, publishing and information management industries. She has 
carried out contracts in the areas of information systems analysis and product development, records management, 
writing, editing, training and teaching. Ms. Nash is the author of several books published in various media and a 
number of technical and popular papers. She holds a Master's in Librarianship, University of Wales, Cardiff, Wales, 
awarded in 1976. 
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This book is about things we do not wish to see happen. Risk is about the chance that "something nasty" occurs. 
Risk management is concerned either with making sure that the "something nasty" is less likely to happen or making 
the "nastiness" more bearable. 

In a nutshell, the above paragraph defines the management of technological risk, the subject of this book. The rest is 
detail — important detail — which can, however, obscure basically simple ideas. Throughout your study of the 
management of technological risk, we urge you to keep in mind the above paragraph. That is, always remember: 

• That we wish to reduce the possible damage from the hazard with which we are concerned and/or 

• That we wish to minimize the chances that this hazard is realized. 

Moreover, in balancing these ideas, the measures we take to reduce the magnitude of damage or the chance of 
occurrence should not cost more than the damages from the original hazard. 


1.1 Definitions 

Risk refers to danger, peril, or possible loss. The Shorter Oxford English Dictionary (SOED, Third Edition, Revised 
with Addenda, 1969) also uses the word "hazard", but we will reserve that word here for the specific event which 
occasions the loss or damage. As indicated, we will be concerned with two aspects of loss or damage: 

• The magnitude of loss, damage or cost which a particular hazard incurs; 

• The probability that the particular hazard is realized. 

To provide a way of comparing hazards and their probabilities of occurrence, we will follow the general practice in 
the field of risk management and define "risk" as the product of these two elements: 

risk = magnitude of hazard * probability of occurrence 

The risks that will interest us are those that arise from everyday things and their use and 
abuse. These "things" that we make and do come from our technologies, the "practical arts" 
(SOED) of a society. Our book comes out of our work concerning the management of 
technological risk, which is the formal name for the subject. Throughout this work, we 
must never forget that "managing" refers to those actions (or inaction) used to control the 
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risk posed by a particular object or situation of interest. 


1.2 Numbers and Probability 

Since hazards are possible but not always realized, an element of chance or probability arises. Estimating the 
probabilities of occurrence of hazards, as well as the magnitudes of the costs which are incurred if they do, are 
difficult aspects of managing technological risk. Probabilities also lead to the use of statistical techniques and ideas. 
Our experience is that the mention of "statistics" can scare even well-informed readers. However, for almost all of 
the examples we will use, very simple concepts from probability and statistics are used. More important, in our 
opinion, is an ability to work well with the simple ideas, especially units of measurement and scaling factors. That 
is, we believe that understanding and managing risk are made much easier if one can recast numbers given by 
engineers and scientists into quantities that have meaning for the average person. 

A good example of this "reworking the numbers" is given by Donald Norman (1992, p. 149) concerning the 
probability of getting stuck in an elevator. Norman shows that the engineer's per-ride probability of getting stuck in 
an elevator of one in 50,000 (or 2 * 1(T 5 ) means that the average office worker can expect to be stuck in an elevator 
twice in a lifetime. "One in fifty thousand" is really not such a small chance because we use elevators frequently 
over a long time. Norman simply noted that five round trips a day (TO elevator rides) is not an uncommon number 
for office workers, with 250 working days a year and a 40 year working life being reasonable approximations, 
giving an expected number of times stuck in an elevator as 

2 * 10' 5 * 10 * 250 * 40 = 2 

that is, 

(probability per-ride of failure) * 

(rides/day) * 

(days/year) * 

(years/working life) = 2 occurrences per person 

This is clearly a simplification, using assumptions that the probability of getting stuck is the same for all elevators 
and that it is uniform over time. Nevertheless, it is good enough for most purposes, and certainly good enough to 
suggest that continued attention to elevator safety is warranted. 


1.3 Examples of Technological Risks 

There are many obviously "risky" human activities. Some examples are: 

• Nuclear reactor construction, operation, and decommissioning; 

• Automobile use, particularly when tired or after alcohol consumption; 

• Open-heart surgery; 

• Test flights in new aircraft; 

• Manufacture and transport of toxic chemicals. 

Some of these issues occupy a large part of the public perception when the word "risk" is used. Other matters are 
equally good candidates for study, with a better opportunity for our managerial intervention, but have a lower public 
profile: 

• Manufacturer's alterations to the design of a home appliance; 
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• Office furniture layout and equipment placement; 

• Choice of medical equipment, instruments and procedures; 

• Procedures for domestic meal preparation. 

From these examples, it should be clear that many, if not most, human activities can be examined from the 
perspective of risk assessment and management. Clearly, such a viewpoint is not always helpful — one can spend so 
much effort preoccupied with the risk aspects of an activity that nothing else gets done. Nevertheless, we hope in 
our case studies and methods documents to encourage the consideration of risks in a wide variety of situations, that 
is, that risk management be a part of overall management of activities. 


1.4 The Importance of Perceptions 

We shall try throughout this book to remain anchored in reality, but we cannot ignore the fact that the management 
of the technological risks we are discussing involves taking account of perceptions and fears. People frequently say 
"I'd rather die" than face some event of particular psychological terror. There are fates worse than death for most of 
us that may be inconsequential to others. We need only think of "spiders and snakes" and other phobic stimuli. 
Unfortunately, a large part of risk management involves dealing with phobias. In particular, we may have to deal 
with the manipulation of phobias by those who believe they will profit by such manipulation, or who simply need a 
"good story" for the news media they represent. 

Perceptions change people’s understanding either of the magnitude of the hazard or the probability of its occurrence. 
For example, Polychlorinated Biphenyl compounds (PCBs) are often described in the news media as "highly toxic", 
yet we have found no record of a human death due to these substances. This does not mean they are "safe". PCBs 
should be handled carefully and proper methods used for their disposal. They do pose risks to the environment and 
its life forms, and in particular are very persistent compounds. They are not easily decomposed. Our point here is 
that they are not acutely toxic or directly threatening to people. The risks they pose are related more to the fact that 
we cannot easily remove them from the environment and that they appear to have long-term untoward effects on 
plants and animals. 

Exercise: Find news media references to PCBs. Are they associated with toxicity? Can you find any indication of 
deaths or injuries? 

In this book, we shall stress the importance of clear, truthful presentation of both the hazards and their probabilities 
of occurrence. We believe that it is desirable that the actual and perceived magnitudes of hazards and their 
probability of occurrence closely approximate each other if risk management is to proceed on a rational path. 


1.5 The Danger of Jargon 

At this point it is worth noting that many of the words used in risk management have acquired their own special 
place in other subject areas. Some examples: 

• In statistics, the words SIGNIFICANT and CONFIDENCE 

• In mathematics, CATASTROPHE theory (which has very little to do with the accidents and disasters we 
shall study here) 

• In insurance, actuaries deal with the statistical concepts of risks under the heading RISK THEORY 

• In engineering, many aspects of safety and reliability are considered to be part of the technical topic of 
RISK ANALYSIS. 

Wherever possible, we shall try to note possible jargon or technical uses of words so that the reader is kept aware of 
potential misunderstandings in conversation with those who may presume a special meaning. We urge all those who 
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present arguments and discussions of ideas relating to technological risks to be careful to place the use of technical 
words in a clearly explained context. Many of the stakeholders (see Section 1.7) in risk management exercises are 
intelligent but not necessarily well-informed of the specific meanings of words in some subject-specific context. 

Sometimes there are alternative terms and usages that minimize possible confusion. Most statisticians will now talk 
of a Gaussian distribution rather than use the potentially loaded term "normal distribution". We encourage such uses 
that place technical terms into a technical context. 


1.6 How Hazards are Realized 

In order for the hazard magnitudes to "count", some of the hazards must actually be seen to occur. Probabilities are 
difficult to think about because they are long-run averages of the number of occurrences of some happening over the 
number of times it could have occurred. Humans are inductive in their logic. We are reminded of a story told to us 
by a professor of chemistry who, when a student, had seen a fellow student accidentally drop a large (and 
expensive!) round-bottom flask which was some 25 cm. in diameter. It bounced, and the student caught it. Making 
an (incorrect) inductive conclusion, the student then deliberately dropped it again, with results that may be imagined. 

If hazards are realized truly at random — in technical terms they arise in a stochastic process — a manager cannot 
control when they occur. It may be possible to reduce the rate of occurrence if we can discover those risk factors that 
increase the probability of occurrence. More likely, management strategies will concentrate on minimizing the cost 
of occurrence to the stakeholder. 

Other hazards are realized when someone fails in their responsibility. Rules are broken, safety warnings are ignored, 
faulty equipment is not replaced or repaired. Here managers can reduce the likelihood a hazard will be realized by 
maintaining a strict regime to control the risks. 


1.7 Stakeholders 

Risks are managed on behalf of some interested party. The interested parties are the stakeholders — the people who 
are affected in some way by a hazard and its possible occurrence, or else by the measures taken to manage the risk 
posed by the hazard. Quite often, there are competing hazards. For example, lack of garbage disposal invites vermin 
and the potential for disease along with smells and unsightliness. Disposal by incineration may release toxins into 
the atmosphere. In our case studies, we shall encourage the identification of all the principal stakeholders in each 
situation. Frequently we shall include governments at different levels because of their regulatory and enforcement 
role. 

While the ideas we present are intended for use by those learning about or engaged in managing potentially risky 
situations, our perspective is deliberately much wider. We view the management of risk as much more than the 
containment of costs, and consider that it is also an exercise in ethics and in judgement. This is because the nature of 
many of the hazards we discuss involve stakeholders who, in the usual course of events, would not have anything to 
do with a particular technology. They are true third parties to the development or use of a technology, such as the 
gardener whose plants are killed by wind-blown weed-killer spray from a nearby park or farm. 


1.8 Principles for Managing Risks 

Assuming that a hazard has been recognized and that at least some fonn of assessment of its probability of 
occurrence has been made, we need to know how to judge between different suggestions for managing the risks. 
There are a number of possibilities. The major approaches which have been used are: 

• Balancing costs and benefits that can be attributed to the technology under study and the measures we take 

to manage risks. Such costs and benefits must be those experienced by the stakeholder for whom the analysis is 
carried out. 
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• Limiting the occurrence or realization of the hazard; reducing the probability of occurrence. 

• Limiting the damage that can be done by a hazard; reducing the hazard magnitude. 

In reverse order, these principles reduce the magnitude or probability of a hazard or their product — the quantified 
risk. Keep in mind these principles when working with any technologies and situations where the risk is to be 
managed or understood. Proposed measures that do not address themselves to these principles will not manage the 
risk. Of course, we have ignored the details again to highlight the simplicity of the underlying goals. 


1.9 General Techniques for Managing Risk 

Based on the principles just listed, we can move quickly to list some of the general techniques that are used for risk 
management. It is instructive to note which principles apply to each technique. 

First, we can do nothing! This surprising management strategy is only recommended where we have a satisfactory 
understanding of the situation. That is, we only choose to "do nothing more to manage the risk" after considering the 
hazard magnitude(s) and probabilities of occurrence and deciding that the cost of taking any action is higher than 
that posed by the hazard. Technologies "generally regarded as safe" or levels of risk that are by regulation or policy 
statement ruled "acceptable" allow of such decisions. In particular, the risks due to such hazards are essentially 
ignored if it can be shown that their probability of occurrence falls below some threshold. 

Second, we can explicitly try to balance costs and benefits of a particular technology. Risk / Benefit analysis is 
essentially a cost / benefit analysis applied to hazards. Alternatively, we may seek the management decision that 
results in the greatest benefit or largest avoided costs — a marginal savings approach. 

Third, we may explicitly try to limit hazard realization. Laws or regulations may require hazard probabilities to be 
below some level using tolerances for occurrence. The elevator failure example of Section 1.2 suggests that the 
elevator engineers are using such an approach by the nature of the per-ride probability of failure quoted. Disaster 
analysis and emergency planning, using scenarios based on projected possibilities or consideration of similar 
situations, aim to reduce the hazard probability by focusing attention on specific situations. They may also serve to 
suggest ways to reduce hazard magnitude. 

Finally, we may try to reduce the costs of hazards to a particular stakeholder. Some stakeholders have been 
successful in having governments regulate the hazard cost. The back of airline tickets states the maximum damages 
that will be paid to passengers or their estates in the case of accidents. The nuclear industry is exempted from paying 
damages in many jurisdictions (for example, the Nuclear Liability Act, passed by the Parliament of Canada in 1970), 
so that household insurance policies have specific exclusions for nuclear accident damage. Thus the regulated 
hazard magnitude for one stakeholder, e.g., the airlines or nuclear industry, has been transferred to others, namely, 
travelers or neighbours of nuclear plants. Disaster management (after a hazard has been realized) can minimize 
damage. This is akin to the role of the local Fire Department, and is a way to reduce some hazard magnitudes. 
Insurance is another, in that the hazard cost of a particular situation is limited to the insurance premium. If our house 
burns down and we have no insurance, our hazard cost is in the hundreds of thousands of dollars, while insurance 
premiums are measured in hundreds of dollars. 


1.10 Assessing Hazard Magnitudes and Probabilities 

The techniques we shall use for estimation of the hazard magnitude and probability of occurrence are taken from a 
variety of fields. 
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Motor not turning over 


Contact OK, car runs 


no spark 


Car won't start 


Shutoff wire loose 


Motor turning but no firing 


out of gas 
broken fuel pump 
/ / , broken fuel line 
blocked fuel line 
shut off valve closed 


Car wor't start 



Shutoff valve closed 


no fuel to engine 

air lock no fuel to engine 

From engineering, we shall use both the fault tree and event tree. A fault tree builds up the possible ways a hazard 
has been realized by listing all the possible ways we can arrive at a specified event e.g., our car will not start. The 
first stage involves such events as the motor not turning over and motor turning over but not starting. The second 
stage traces back the causes for each of these e.g., if the motor will turn over but not start, then possible causes are 
no fuel or no ignition spark. Listing such events and placing them on the tree is a lot of work. Adding the 
probabilities is an order of magnitude more difficult. 


Event trees perform a similar analysis in the opposite direction. Instead of tracing a fault backwards to its potential 
causes, we consider all the possible outcomes and implications of an event. Using our car example again, suppose 
the wire to the fuel cutoff valve has vibrated loose. This wire is commonly attached by a friction fitting spade-lug. 
The cut-off valve — a safety and economy device — is opened when the ignition is turned on and allows fuel to be 
pumped into the carburetor. If the wire is loose we get no fuel to the engine, which will still turn over but not start. 
We have traced the event "wire comes loose" forward to "car will not start" in one path through the event tree, which 
should include the other ramifications of the initial event. Again, listing the events and attaching probabilities is a 
gargantuan job. 

Figure 1.10. a) Partial example of a fault tree b) Partial example of an event tree 

From statistics we shall borrow various techniques in exploratory and confirmatory data analysis, some actuarial and 
epidemiological methods, and certain Bayesian approaches to estimation of models. Some of these techniques are 
quite specialized or require relatively advanced statistical knowledge. However, many of the data analysis 
techniques, including those used by actuaries and epidemiologists, rely heavily on simple graphs and tables. (An 
epidemiologist once told us that an epidemiologist is a scientist broken down by age and sex — truly one of the most 
common two-way tables used to discover patterns of incidence of diseases.) 


In keeping with our general philosophy in this book, we will stress the use of well-chosen simple statistical tools. In 
our experience, the understanding of a subject gained from the simple techniques almost always contains the main 
features of a more complete, more advanced, analysis. We note, however, that the simple techniques must be 
selected, adapted or applied carefully. 


When the data on a particular hazard is fragmented, we may be forced into using less complete methods of analysis. 
Scenario writing allows us to postulate what might happen or be happening. It is a cousin of the fault tree and event 
tree techniques when we are obliged to do more guessing. Detailed scenarios, together with order of magnitude 
estimates of some of the hazard magnitudes and probabilities, allow crude risk/benefit calculations to be carried out. 
We use this approach in our case study of cosmetic risks. 

Scenario writing can be extended to simulation of processes if we supply random number generators to provide the 
timing of and damage done by hazards. The results of a number of "runs" will give a picture of what might happen 
in reality. This picture is only as good as the assumptions and estimates or guesses of the hazard magnitudes and 
probabilities supplied to the simulation. 


In the most extreme case, subjective methods may boil down to asking someone we presume to be expert for their 
opinion. This can be formalized into special interview approaches, possibly combined with feedback in panel-of- 
experts methods, or even moderated anonymous panels under the Delphi technique. The numbers we get are still 
guesses, but perhaps they are better guesses than those we make ourselves. 


1.11 Obstacles to Risk Management 
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While this book argues strongly that risks should be managed, we must acknowledge that the job is not an easy one. 
First, there is almost always a lack of good data. There is rarely a shortage of anecdotal "data", the wonderful and 
interesting stories of this or that disaster. The actual dollar figures for damages or the rate of occurrence of a 
particular hazard are usually very much more difficult to find. 

To compound our troubles, many organizations do not want information about their technology or product tossed 
about in public discussion. This leads to organizational secrecy. It is fed by legal and public relations concerns, 
abetted by governmental preoccupation with commercial confidentiality and bureaucratic tendencies to classify 
practically any interesting document as off-limits to public gaze. 

Even if there is open and frank release of information, it may come far too late for management use. Many of the 
phenomena of interest, e.g., toxic effects of food additives, may have exceedingly long delay times before effects are 
noticeable. 

Finally, once we have "good" data about the damage done by a particular hazard, we may find that our unit of 
measure for damage is human lives, for example, in vehicle passenger restraints. The risk management costs, 
however, are in dollars. This forces us to place a value on a human life, miring our discussion in an unwinnable 
debate. This issue cannot be ignored, but it is truly not resolvable. 


1.12 How We Present Case Studies 

Throughout our work we will try to present the case studies in a uniform way. We have found this structure very 
helpful in keeping discussion on the topic, even when the stories and side-issues are so much more entertaining. 
Indeed, this is the prescribed format for case study papers in courses we teach. The elements that each case study 
should address, more or less in the order given, are: 

• A statement of the situation to be discussed, its background and history, outlining the hazards and benefits 
and how they arise; 

• A list of the major stakeholders, with certain standard societal stakeholders such as governments, regulators 
and the media almost always included, detailing their particular interests in the case; 

• A quantification of the hazard magnitudes for the stakeholders of interest; 

• A quantification of the benefits, if any, for the stakeholders; 

• A risk assessment, that is, estimation of the probabilities of occurrence of the hazards; 

• A statement of alternatives and strategies for management of the risks, using the principles and techniques 
outlined above; 

• Where appropriate, a set of recommendations should be supplied — the analyst should present an opinion 
and not pretend to be totally detached from the subject; 

• A statement of open questions may be included to highlight particular issues or lack of data that could be 
remedied by further study; 

• References and a further reading list to allow the reader to follow up the case study with verification of the 
data provided and additional study. 

The last feature above, the reference and further reading list, is often lacking in articles on risk, particularly those in 
popular magazines. Thus it may be difficult to distinguish solid hazard data from leaps of logic based solely on 
anecdotal evidence. At least when references are given we can try to check the sources. This may be small enough 
comfort when there is very limited information on a hazard, but it is much better than unsupported declarations that 
belong, if anywhere at all, in supermarket tabloids. 


© 1993-97 Nash Information Services Inc, 1975 Bel-Air Dr, Ottawa, K2C 0X1 Canada Copy for archive.org 

Managing Technological Risk: Case Studies and Methods Introduction 1 - 5 



1.13 References 


Health-Risk Perception in Canada: A Research Report to the Department of National Health and Welfare (1993) 
Ottawa: Minister of Supply and Services Canada, CAT. No. H46-2/93-170E 

Norman, Donald A. (1992) Turn signals are the facial expressions of automobiles. Reading Mass.: Addison-Wesley. 
204 p. 


© 1993-97 Nash Information Services Inc, 1975 Bel-Air Dr, Ottawa, K2C 0X1 Canada Copy for archive.org 

Managing Technological Risk: Case Studies and Methods Introduction 1 - 6 



2: Why Accidents Happen 
- Short Stories 


2.1 Why accidents happen 

2.2 Thalidomide, 1957-1961 

2.3 Daikon Shield, 1971- 

2.4 The Bhopal Incident, December 2-3, 1984 

2.5 Challenger explosion, Jan. 29, 1986 

2.6 Chernobyl Explosion, April 25-6, 1986. 

2.7 Symptoms of enhanced risk 

2.8 References 
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2.1 Why accidents happen 

A sub-theme in this book will be "why accidents happen". We believe that the management of risk often involves 
watching for those situations where accidents or catastrophes are likely to happen. In our view, and here we are 
unashamedly editorializing, accidents happen when people let go of the controls. That is, the design, the 
engineering, the planning and the intentions are all good, but along the way the rules are violated. Furthermore, 
when the rules are violated, no one takes any notice, or worse, refuses to take notice, of these violations. 

To underline our point, we will give some examples. These cannot PROVE our point that letting go of the controls is 
the reason accidents happen. However, we believe that the examples show enough of a pattern to suggest, and 
suggest strongly, that no amount of design work, risk assessment and planning, or rules and laws, can prevent people 
from behaving stupidly, even when warned that they are so doing. 

While this may be a pessimistic viewpoint, and suggest that no endeavour be undertaken which involves the creation 
of any risky technology, we feel that a more constructive view is to provide training and education to enable people 
to recognize and respond to dangers. No technology is itself dangerous — our society has too many people to be 
able to survive without the tools and methods we have devised over the centuries. 

The short examples here go beyond the "everyday" theme of our title, though air travel, contraception and 
tranquillizing drugs are common. The choice has been made primarily because the role of management or mis¬ 
management may be discerned in the stories and serve to inform us. 


2.2 Thalidomide, 1957-1961 

Thalidomide is a name which raises immediate and unpleasant images of deformed children — now handicapped 
adults. Realistically, it must be regarded as a sequence of events in which the management of risk was generally so 
absent that seven of the executives of Chemie Grunenthal, the company which put the product on the market, were 
criminally prosecuted in Aachen, Germany because: 

• They put on sale a drug that even when taken according to instructions caused an unacceptable degree of 
bodily harm. 

• They failed to test it properly. 

• They went out of their way to advertise it as safe when they could give no guarantee that it was. 

• In fact, it caused those who took it to itch, sweat, vomit and suffer peripheral neuritis. 
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• When these reactions were reported to company management, they first brushed them aside; some of them 
lied to doctors who questioned them; and when reports became too insistent to ignore, they did all they could to 
suppress them. 

• The drug caused an "epidemic of malformed babies." (Knightley et al. 1979, p. 123) 

The prosecution was dropped in order that the victims might be paid some compensation within a short time rather 
than wait the years which would have to elapse before court appeals were exhausted. 

As with many technological disasters, we should not blame the technology itself, but the deliberate short-circuiting 
of controls and safeguards by those who should have known better. Knightley et al. (1979, p. 52ff) further point out 
that a myth has developed that testing for teratogenicity (monster-producing effect) was not common before 
thalidomide, whereas a number of drug companies were routinely testing for such possibilities. 

The thalidomide story is complex, detailed, and depressing. Few of the players come out of it with honour. A clear 
exception is Dr. Frances Kelsey of the United States Food and Drug Administration (FDA), who resisted some quite 
unpleasant pressure by Richardson-Merrell, the American licensee of thalidomide, to release the drug for use. As it 
was, Richardson-Merrell gave away "528,412 tablets to 1267 doctors who gave them to some 20000 patients" for an 
"investigational program". Because many of these hand-outs were without prescription, there were often no records 
of who received the pills! Nor, we may imagine, was there a complete list of who may have suffered personal injury 
in the form of peripheral neuritis ("pins and needles", generally in the hands or feet, possibly permanent), or familial 
disaster in the form of a deformed child. 

Dr. Kelsey was, after the fact, feted as a heroine. Yet, as Knightley et al. (1979 p. 81) point out, she simply asked the 
correct questions which should be posed whenever a new drug is put forward for approval. These questions focus 
on the risks raised for the benefits received — the meat of this book. In the case of new drugs, the onus of proof of 
safety is on the proposer, and the FDA is quite stringent in the conditions of tests. Kelsey would not accept some of 
the sloppy data given to her via Richardson-Merrell from Griinenthal. Moreover, she caught Richardson-Merrell 
withholding important information about dangers of thalidomide. Since there were many alternatives to thalidomide, 
and it was not used to treat any life-threatening situations, Kelsey simply applied standard rules to the case and 
refused to grant approval. 

In other countries, approval was given for distribution, and in West Germany thalidomide was an over-the-counter 
drug. Despite advertising material from the manufacturers about the "safety" of thalidomide for the patient, there are 
many cases of unwelcome side effects. The manufacturers seem to have done little to research these, nor to 
determine how thalidomide was taken up and processed in the human body. Such work was carried out later. To 
underline the sloppiness of Griinenthal, Knightley et al. (1979, Appendix) commissioned Fulmer Research Institute 
(consulting chemists) to try to duplicate the syntheses of thalidomide. Their report suggests that even the basic 
laboratory chemistry reported in the patent application was incorrect! 


2.3 Daikon Shield, 1971- 

The sorry tale of the Daikon Shield intra-uterine contraceptive device illustrates another situation where human 
arrogance and greed led to injury of thousands of women. Here we will not present the entire story in any detail, 
since others have chronicled the introduction, marketing, and demise of the Daikon Shield (Mintz 1985; Perry and 
Dawson 1985). 

From the perspective of "why accidents happen", we will look at the main failings on the part of the men (there 
appeared to be few, if any, women involved in the development and marketing of the device) who introduced the 
Daikon Shield and of A. H. Robins who took over the product. 

• The research work on which the decision to commence marketing was based was seriously flawed. Such 

investigations attempt to establish the effectiveness of a product like the Daikon Shield in preventing pregnancy, as 
well as its safety in causing no infections, tubal pregnancies and miscarriages. Tests would also determine its 
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acceptability to the patient in terms of ease of installation, comfort, and ability to be removed easily. The studies 
carried out were of very short duration — it appears that the average patient was followed for only 5.54 months 
(Mintz 1985, p. 31). There were also concerns about an apparent high rate of drop-outs from the study. One may 
suspect that such drop-outs were caused by failure to tolerate the device or pregnancy, so that reported efficacy and 
safety results were compromised. 

• The manufacturing design of the Daikon Shield used a multi-strand nylon cord which was coated to prevent 

microbial entry. In tests, it has been found that the coating is rather easily compromised, allowing vaginal flora and 
fauna to be sucked into the normally sterile uterus by capillary action. This wicking tendency was known to the 
makers of the Shield quite early in its history, but was, it appears, deliberately ignored (Mintz 1985, chapter 8). 

As in the case of thalidomide, once legal action was started, A H Robins and its insurers took a very aggressive 
stance, as described by both Mintz (1985) and Perry and Dawson (1985). This is of great general interest, mainly in 
indicating a continued lack of morality and good strategic management on the part of A. H. Robins, but it is only 
indirectly related to the technological risk. 

The withdrawal of the Daikon Shield and the subsequent program to find any women still using it, gives some idea 
of the "hazard" to a manufacturer who refuses to take risk assessment and management seriously. Unfortunately, in 
the United States at least, the uproar associated with the Daikon Shield has resulted in no intra-uterine contraceptive 
devices being available to women. Clearly IUDs have risks, but there are women who for medical reasons cannot 
use systemic contraception (the "Pill") and for whom an 1UD might offer an appropriate informed choice, especially 
if a woman is offered regular monitoring of her health status. There is thus a "hazard" to a more general segment of 
society in the failure of one example of a technology, since all forms of that technology became unavailable. 


2.4 The Bhopal Incident, December 2-3, 1984 

Here we will summarize what we believe are the major reasons that this "accident" happened. The whole story is 
much more complicated, but we believe this account captures the main management issues. 

First, it is important to note that the Methyl Isocyanate (MIC) unit at the Bhopal plant was reasonably well equipped 
with safety devices. However, at the time of the leak — since it was almost so predictable as to be mis-named an 
accident — a number of devices were inactive for various reasons: 

• A safety device called a slip blind, designed to ensure a pipe is closed, was not in place (Union Carbide 
1985); 

• A pipe to the flare tower had corroded but not been replaced (Kottary 1984; Khandekaar, Sreekant and 
Dubey, Suman 1984) This pipe was used to harmlessly bum off materials which burst through pressure safety 
valves, but had apparently been shut down for maintenance (Aro et al. 1985); 

• A scrubber designed to remove MIC from escaping gases was not working (Kottary 1984); 

• Refrigeration to keep the MIC tank cool was not working (Kottary 1984). 

A number of other factors could be considered as contributing to the extent of the disaster that the MIC leak created: 

• title to land near the plant had been given to squatters by local government, contravening federal 
regulations (Economic and Political Weekly 1984); 

• Inexperienced and untrained employees staffed the plant at the time of the incident; some spoke only Hindi 
but all operating manuals were in English (Statesman (Delhi) 1985; Aro et al. 1985); 

• Lack of enforcement of safety controls and regulations, including laws prohibiting people living withing 2 
kilometres of the plant (Time 1984, p. 20); 

• Political interference and nepotism (The Economist 1984; Newsweek 1984; Subramaniam 1984); 

• The plant was losing money (Subramaniam et al. 1985). 
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There are various theories about the final triggering of the leak, which occurred when the MIC reacted with itself 
exothermically, forcing the substance out of the tanks and into the atmosphere via a pressure safety vent. Union 
Carbide has indicated (1985) "water could have been introduced inadvertently or deliberately", and in a news 
conference hinted at sabotage (Ottawa Citizen 1985). Our own conclusion in early 1985 (Nash et al. 1985) was that 
water was introduced, probably accidentally by a poorly trained employee, during pipe cleaning which was going on 
in the system just before the leak. 

The Bhopal disaster was compounded by the bad luck that the MIC did not catch fire or explode. If the MIC had 
blown up, more employees would have been hurt and possibly killed and the plant damaged, but it is unlikely so 
many city residents would have been killed or injured by the gas. 


2.5 Challenger Explosion, Jan. 28, 1986 

The destruction of the U.S. space shuttle Challenger on Jan. 28, 1986, at approximately 11:38 a.m. EDT, with the 
loss of life of all seven crew members is another illustration of managers refusing to objectively assess risks. 
McConnell (1987) provides a narrative of the problems and difficulties faced by the U.S. National Aeronautics and 
Space Administration (NASA) in managing a series of launches which were beyond their capability in manpower 
and money. In particular, McConnell emphasizes several indirect and direct sources of the disaster: 

• Contract award irregularities: McConnell suggests that political interests steered the major shuttle contracts 
to Morton Thiokol (for the solid rocket boosters) and to Rockwell International (main engines and orbiter), when 
other bidders offered more experience and capabilities. 

• Inter-agency competition: different parts of NASA had responsibilities for different parts of the manned- 
space program. In particular, the Marshall Space Flight Center was responsible for the propulsion system (i.e., the 
engines), the Johnson Space Center in Houston for the crew training, and the Kennedy Space Center at Canaveral 
for putting the pieces together and getting them launched (safely?) into space. 

• Publicity value of human space flight: NASA was persuaded to accept "passengers" on its shuttle flights. 
The Challenger's passenger was teacher Christa McAuliffe. She had been preceded by Senator Jake Gam and 
Congressman Bill Nelson. The passengers (called Payload Specialists by NASA) were used to showcase the shuttle 
technology, so that delays or "scrubbed" launches with passengers on board were viewed negatively. Challenger was 
launched in adverse conditions — there was ice on the launching structure, and the temperature was lower than on 
any previous launch. Indeed, a number of instruments were not supposed to be used if their temperature fell below 
certain limits. These limits were exceeded on the day of the launch, yet officials signed releases that it was still 
"safe" to launch. 

• Putting wishes before clear thinking: This is doubly dangerous when scientists answer as human beings 
when they are expected to respond as scientists. C.P. Snow puts it clearly (1964, pp. 265, 266) as "craving for action. 
... The craving came out through layers of patience, mixed with all the qualifications and devices of discipline, as 
though it were the reasonable, considered recommendation of a wise and prudent man." 

Those responsible for deciding whether to launch Challenger, clearly did not wear their scientific hats on 
the morning of the explosion. They wanted to launch, and launch they did, despite warnings and objections 
from their employees. In making their decisions, they implied that objective criteria had been used, when it 
seems obvious that emotions got in the way. 

The Rogers Commission which investigated the explosion concluded that the disaster was caused by failure of an O- 
ring seal in one of the solid rocket boosters. Such a possibility was discussed by Morton Thiokol employees on the 
night before the fatal launch. However, data presented to decision-makers only showed O-ring damage versus 
temperature for cases where there had been damage. (It appears that the data was omitted out of ignorance of its 
statistical importance.) If cases with zero damage are also reported, the correlation between O-ring damage and 
temperature is much clearer (Dalai et al. 1989). Dalai et al. compute an estimate of the probability of failure on the 
morning of Jan. 20, 1986 at no less than 13%. This would drop to 2% if the temperature had been 60 degrees F. 
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2.6 Chernobyl Explosion, April 25-26, 1986 


As if to underline that both East and West can ignore warnings and make emotional judgements, the number 4 
reactor at Chernobyl was allowed to explode on the night of April 25-26, 1986. (Silver pg. 8-11) 

Once again, we have engineers who should know better deciding that safety devices can be switched off because 
they are in the way of running tests. In the case of Chernobyl, the test was to investigate whether a reactor could be 
shut down safely using only power it is itself generating. This is important, because it takes power to drive the 
pumps which circulate coolant through the reactor. Neutron-absorbing control rods are the tool used to control the 
actual rate at which the reactor produces energy; they absorb spontaneously emitted neutrons which could trigger 
further nuclear fissions. However, even after no induced fission is happening there is still a lot of heat built up in the 
fuel, pipes and other reactor material which must be dissipated or the reactor core can melt or, as in the case of 
Chernobyl, a mechanical steam-explosion can occur. Silver (1987) points out that there were a number of factors 
leading to the explosion and fire: 

• Safety systems were shut down to conduct tests and not reactivated afterwards. 

• Decisions were made which appear to have had no scientific or managerial justification, but which limited 
the options of the controllers. 

• The test which initiated the explosion appears to have been carried out more for reasons of intellectual 
curiosity than genuine need to know. Worse, it does not seem that those conducting the tests recognized the 
consequences of some of their actions. 

The particular structure of the government of the (then) Soviet Union at the time of the Chernobyl explosion allowed 
information about it and the subsequent fire and release of radioactive material to be suppressed until Western 
observation instruments caused questions to be asked by foreigners. It may, however, be possible that the same 
structures of government allowed a quick response to be made to the problems of the fire and radiation escape. This 
can, of course, be debated. (In many quarters, the response of Canadian authorities in the Mississauga train 
derailment of November 1979 is considered to be laudable, and this under a system where there are often 
overlapping federal, provincial and municipal administrations.) 


2.7 Symptoms of enhanced risk 

These short cases and longer ones both in this book and elsewhere suggest that we should view the occurrence of 
more than one of the following events or situations as a warning of impending disaster. Individually, the symptoms 
are relatively innocuous; when they occur together they serve to raise the alarm that risk is rising. The symptoms 
are: 


• The disabling or tampering with safety measures. 

• An organization or activity in a declining or money-losing state. 

• A tendency of management to seek to blame staff or workers for “accidents” rather than developing 
systemic safety and security measures. 

• An ethical or moral environment that puts profit ahead of people. 

• An attitude of "It'll be OK. Nothing can really go wrong." 

• Lack of training of staff, not just in safety matters, but in all aspects of their jobs. See Connors (1997). 

Exercise: Prepare a "short" case study of the issues surrounding the US Air / Skywest collision at the Los Angeles 
airport on the Feb. 1, 1991 crash between a Skywest turboprop and a USAir Boeing 737 that killed a total of 34 and 
injured a number of others. Starting references are Domheim, M.A. (1991a, 1991b). 

The purpose of the stories in this collection is to provide pointers that highlight when disasters are more likely to 
occur. Risk management requires that we learn from mistakes, that we put in place mechanisms that will help us to 
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see when the danger level is increasing, and that we understand why things go wrong. This does not mean that 
catastrophes will not occur in the future, nor that we will not be their victims, but it does give us the opportunity to 
use our own efforts to minimize the risk where we do have influence. 
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3.9 Further Reading 


3.1 Lotions and Potions - Background 

The urge to be beautiful, to remain so as one ages, or to alter one's appearance has been strong in the human being 
since the beginning of time. The use of products to enhance physical attractiveness is so pervasive that there is 
probably no one on the face of the earth who does not use at least one cosmetic product, whether it is home-made or 
formulated by one of the great cosmetic names of the world. 

Beauty may be in the eye of the beholder, but psychologists have discovered there is a strong correlation between 
how people judge a person's physical attractiveness and how highly they estimate that person's personal traits and 
potential for success in career and life in general. Landy and Segall (1974) found that a group of male 
undergraduates graded a female student's essay higher when the picture attached to the essay portrayed an attractive 
woman rather than an unattractive one, even when the essay was poorly written. Berscheid and Walster (1972) found 
that as early as kindergarten, attractive people were judged to be better persons. Later in life attractive appearance is 
very important in opposite-sex dating, even though subjects admitted that it was vulgar to judge by appearance. As a 
consolation for those who are concerned about their appearance, the same researchers found that those judged to be 
more attractive early in life were less happy, less satisfied and less well-adjusted twenty-five years later. 

The researchers merely confirm what most people suspect. Consequently the cosmetic industry is worth many 
billions of dollars each year, with thousands of different products on the market and many hundreds of new ones 
being introduced each year. We hesitate to quote exact figures, since the industry classifications can become 
confused and fragmented. For example, there are overlaps with soaps and pharmaceuticals. Soaps are usually 
excluded from the definition of cosmetics but the "fancy" variety are commonly sold at cosmetics counters. The US 
Food and Drug Administration (FDA) has classified anti-perspirants as drugs, while other deodorants are cosmetics 
(Winter, p. 41). There are even "cosmeceuticals", at least according to the marketers of one product sold to reduce 
facial wrinkles (Gillman and Gillman 1991). It was estimated recently that the Canadian population spends $900 
million annually on cosmetics in general and as much as $340 million on men's cosmetic products alone (Globe and 
Mail 1993). An earlier estimate of the Canadian cosmetic industry in 1988 and 1989 was $1.5 billion and $1.6 
billion respectively (Baker 1990). The differences between these estimates may reflect different industry 
classifications of products. 

The word ‘cosmetics’ comes from the Greek kosmetikos meaning to arrange or adorn, and commonly, cosmetics are 
preparations for beautifying the hair, skin or complexion. Often the definition is extended to include personal 
hygiene products such as toothpaste, deodorant, mouthwash, etc. but, as mentioned, for regulatory purposes soap is 
specifically excluded. 

Sunscreens will not be discussed here since the US FDA has recently classed these products as drugs because their 
mix of chemicals have the physiological effect of protecting the user against sunburn (Consumer Reports 1991). 
However, we note that a number of familiar products of the "skin moisturizer" type now have versions with UV 
protection ingredients added. It is arguable that these should be classed as cosmetics rather than drugs. 
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On 27 July 1976, the Council of European Economic Community (EEC) published a definition of cosmetics in 
directive 76/768/EEC: 


"A cosmetic product means any substance or preparation intended for placing in contact with the 
various external parts of the human body (epidermis, hair system, nails, lips and external genital 
organs) or with the teeth and the mucuous membranes of the oral cavity with a view exclusively or 
principally to cleaning them or protecting them in order to keep them in good condition, change 
their appearance, perfume them, or correct body odors." 

Thus "cosmetic" includes a variety of products in addition to the usual personal or theatrical "make-up". They have 
been a part of human life since the beginning of recorded history to cleanse, correct blemishes, smooth or even out 
colour tone, to define, emphasize or diminish certain body features or to ensure a similarity of appearance within a 
group. From the outset, people have been willing to take risks in using cosmetics. Dangerous ingredients may still be 
used. In 1974, in Kano, Nigeria, we were shown a "mascara", apparently made with antimony metal! 


3.2 Itch and Ouch - Stakeholders and Hazards 

A unique aspect of cosmetic products — as opposed to other creations of technology — is that some are used by 
almost all members of the human species. Thus, if any are hazardous, it is quite likely that the number of subjects 
exposed to the hazard is very large. Moreover, 

• The exposure frequency is often very high — many cosmetic products are used on a daily basis; 

• The contact duration is very long — make-up and skin lotions are in contact with skin for many hours at a 
time; 

• More than one product may be applied every day and these products, thus mixed, may give rise to 
unanticipated synergistic effects on an individual. 

The most obvious stakeholders in developing a risk profile for cosmetics are the users, which essentially means the 
entire human population. 

Consumers do, of course, select which cosmetics they use, and so those products which may be considered as "high- 
risk" in some way, such as depilatories or hair colouring agents, may only be used selectively. Chemicals in hair 
dyes have been suggested as risk factors in breast cancer for women (Segal 1991). 

Those who share cosmetics may be at a particular risk. There are reports of outbreaks of conjunctivitis arising from 
the sharing of eye make-up in a girls' school, and concern over the possible transfer of micro-organisms between 
those sampling cosmetics at sales counters from common "tester" containers (Schwartz et al. 1989; Sweet 1990). 

Besides the users, we must consider those who inadvertently come in contact with the product: 

• Children or pets, who may ingest the products (such as one of us who, as a young child, licked a perfume 
applicator, fortunately without serious consequences); 

• People who share space with cosmetic users and who suffer from sensitivities or allergies to cosmetics that 
are volatile or may be spilled such as perfume or talc; 

• Workers in the cosmetics industry, especially beauticians or sales staff, who have direct contact with the 
products or their components. 

Beyond the users, we consider the following as stakeholders in our exercise, though the risks they face are more 
financial than personal: 

• Governments at different levels who must be concerned with regulation and enforcement of the industry, 
and with the disposal of unwanted products or their (often voluminous) packaging; 


© 1993-97 Nash Information Services Inc, 1975 Bel-Air Dr, Ottawa, K2C 0X1 Canada Copy for archive.org 

Managing Technological Risk: Case Studies and Methods Cosmetics 3-15 



• Manufacturers and vendors, who presumably do not wish to suffer product liability suits or other penalties 
for putting a hazardous product into the marketplace; 

• Medical practitioners, especially dermatologists, allergists and plastic surgeons, for whom cosmetic 
reactions or accidents can be expected to create "business"; 

• The media, who receive large revenues from the advertising of cosmetic products, and who sell their output 
with news and features that often deal with positive or negative stories involving cosmetics. 

Note also that cosmetics cause a waste problem — the containers are nearly always NON-reusable and NON- 
recyclable. Worse, the ingredients are designed to be stable — they will not decompose quickly. 

A further negative aspect of cosmetics is that the energies and monies spent manufacturing, marketing, acquiring, 
applying and disposing of them are not available for activities which may be of far greater benefit to society. This 
argument is, of course, one which can be applied to a very large number of human activities. Nevertheless, the 
wastes created by cosmetic manufacture and use are such that the argument can be especially well-sharpened here. 

There are administrative costs in identifying the particular ingredients, combinations of ingredients and origins of 
products (regulatory costs), with concomitant benefits to those so employed. 


3.3 Pain in the Wallet - Quantifying the Hazards of Cosmetics 

To quantify the hazards (or benefits) which the stakeholders face, we primarily want to know what could go wrong 
for the stakeholders and how much it would cost to correct the problem or pay damages. The cost is dependent on 
the type of effect or outcome. For example if the effect is minimal such as a temporary skin rash, then the costs 
would be those of acquiring the product, discarding it on discovering the problem and a possible doctor's visit. The 
total cost involved would probably be less than $100 to the stakeholder. The doctor might benefit to a roughly 
similar extent. Given the minor nature of these events, it is unlikely there is regulatory involvement, and the 
manufacturer is probably not informed. 

Indeed, in our opinion, there is likely to be gross under-reporting of minor problems with cosmetic products. This is 
supported by comparing independent studies of cosmetic side-effects with manufacturers' complaints files (Nater 
and de Groot 1983). For example, a study of manufacturers' complaints files indicated 2 incidents per million 
cosmetic units sold, while a US FDA study indicated that there were 15 severe incidents per million cosmetic units. 
A study in Flolland gave estimates of 5 to 10 severe experiences per million cosmetic units. 

A more serious incident, such as an allergic reaction or asthma attack, adds the costs of medication needed to 
overcome the problem. In a Canadian context, the total 1993 costs would be in the range of $100 to $1000 to the 
user per incident. At the extreme, outcomes include such long term effects as cancer or death. We are then forced 
into the common but awkward problem of estimating the value of a human life. Figures in the hundreds of thousands 
of dollars are appropriate here. 

There are some hazards that are difficult to cost. Fragrances can cause allergic reactions of many forms for many 
people, but may induce annoyance or anger in those who do not like the smell. This is a common "pet peeve" 
expressed in the Ann Landers and Dear Abby columns of newspapers. Certain perfumes cause a change in skin 
pigmentation that persists for some time called berloque dermatitis for which there is no effective treatment. These 
outcomes are the opposite of those intended. Similarly, since cosmetics often use alcohols or other flammable 
liquids as solvents or carrying media, they pose fire hazards. Spray cans, now disappearing as a result of concern for 
the environment, have resulted in some nasty fires. A user of hair spray received serious bums and lost her hair by 
trying to apply the spray while smoking. But should we say this is a cosmetic risk? 

3.4 Smile on the Face — Quantifying cosmetic benefits 

The benefits of cosmetics, more than most technologies, are perceived rather than actual. We are forced, as in 
studying risk perception to resort to indirect measurement of the benefit. Psychometric methods could be used, but 
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we will suggest simpler approaches. First, it is worth considering the benefits relative to an alternative technology. 
For example, we can consider toothpaste and compare it with pumice or baking soda, both of which can scratch 
tooth enamel. The toothpaste may serve as the delivery mechanism for fluoride which helps prevent tooth decay in 
addition to the cleaning and massaging effect of the brush and cleaning agents. Similarly, we may contemplate the 
alternatives to shampoos for keeping hair and scalp clean, or to hand and face cream for overcoming skin dryness. 

We should also not forget that cosmetic users themselves provide a very good lower bound to the perceived benefits 
— the price paid for a product must somehow be less than or equal to its value to the person paying. And as we have 
stated, Canadians spend around SI billion each year. Their US counterparts were estimated in the late 1980s to 
circulate $17 billion through the cosmetics industry on an annual basis. 

Clearly some employers feel cosmetics have a positive value. Teresa Fischette, a Continental Airlines ticket agent, 
was fired for NOT wearing make-up. Despite company policy she refused to wear foundation makeup and lipstick. 
In early 1991 she won her job back in a court ruling which stated that employers could not require the use of 
cosmetics as a condition of employment (Kleiman 1991). 


3.5 All those bottles and tubes! - Risk Assessment 

Clearly, there are grave difficulties in preparing even estimates of the hazard and benefit magnitudes in this topic. 
Nevertheless, by considering the possible hazards of different products, we may be able to suggest good 
management strategies. Therefore we will now look at different types of products and the dangers they may pose. To 
provide an illustration of the range of products, we sampled our own household, which is one where little make-up is 
used (MN), and male shaving has been outlawed since 1969. That is, our household is likely to provide an under¬ 
estimate of the usage of certain cosmetic products. Nevertheless, Table 3.5 presents a list of the products we found 
and a list of the ingredients, either from the labels or from Winter's (1989) compendium of cosmetic ingredients. 

We have tried to provide some estimate of the magnitude of the hazards presented to users of cosmetics and others. 
We observe that there are a few potentially grave consequences, with many more unpleasant but mainly annoying 
hazards. 

The purpose of the risk assessment is to estimate the probabilities the hazards will be realized. As we have noted, the 
estimation of the frequency of occurrence of minor problems with cosmetic products is hindered by a likely high 
rate of non-reporting. The wide usage of the products means that the overall RISK = FIAZARD * PROBABILITY 
could still be very large, even if not disastrous on a societal level. 

We expect, given the testing regimes used to avoid difficulties with cosmetic products, that the probability of 
adverse reactions for anyone is very low. Conversely, the population of users is so large, and the manner of usage so 
uncontrolled, that we anticipate acute adverse reaction will be observed quite soon after a product is made available. 
That is, we expect any hazard that can be realized will be realized. Correctly attributing the causes of difficulties 
will, however, be problematic, since people use a number of products, often at the same time. Moreover, for hazards 
such as cancers and chronic disorders such as asthma or emphysema, there are long lead times from initial exposure 
to diagnosis, as well as confounding effects of occupation, smoking, and other lifestyle factors. During the long 
interval before effects are noted, the user may change products and the products themselves may be reformulated. 
Thus the cosmetic use may not be linked to the serious consequences, and we may underestimate serious outcomes. 
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Table 3.5 Ingredients in our sample of cosmetics. 


Where package gave no list of ingredients (labeled no list below), we report a summary of comments from Winter 
(1989) relating to the product type. Alphabetic listings imply more than one container was examined. 

1) deodorant stick (no list): 

Can cause stinging, burning, itching, sebaceous cysts, enlarged sweat glands, and underarm pimples. Lung 
and throat irritation has been reported for spray deodorants. Suggested link between spray deodorant use 
and onset of Alzheimer's disease due to ingestion of aluminum (Economist 1991; Easley 1990; 
Roemer,1989). 

2) emollient skin cleanser (no list currently. A list was found on an older container.): 

• Entsufon: We could not find entsufon hazards. 

• Lanolin cholesterols: Winter (1989) notes that lanolin has been observed to cause allergic 
reactions, but derivative compounds cause less trouble in this regard, but are not totally free from reactions 
in the sensitive. 

• Petrolatum (as an inactive ingredient): generally nontoxic; allergic skin reactions in hypersensitive 
individuals. 

3) bath cubes (no list): 

• Sodium sesquicarbonate: irritating to skin and mucous membranes, may cause allergic reaction in 
the hypersensitive; 

• Cornstarch: may cause skin rashes and asthma and allergic reactions; 

• Mineral oil: nontoxic 

• Talc: can cause lung irritations; see baby powder. 

• Fragrance: may cause allergic reactions 

4) baby powder (no list, but "Made from superior talc"): 

Talcum powder linked to ovarian cancer if used on female genitalia and sanitary napkins (Winter 1989, 
p. 4); can cause coughing, vomiting or pneumonia when inhaled by babies. 

5) hairstyling mousse (no list, only an indication that it does not contain alcohol, which would dry > out the 
hair): 

There may be risks from the pressurized container. 

6) Face cream (no list): 

These products are designed to make skin feel softer and smoother. Many common ingredients are allergens 
for some users. 

7) toothpaste (two different products) 

a. Sodium monofluorophosphate or sodium fluoride has been reported to cause tooth enamel mottling. No 
known skin toxicity. 

b. Strontium chloride: We found no listing of toxicity for this. 

8) handlotion (two different products. No lists, but announced "with Vitamin E") 

a. No ingredients listed - see face cream. 

b. Vitamin E (Tocopherols) - no known toxicity, but there are reports of rashes, blisters, and swollen feet. 

9) hair remover 

A main ingredient, calcium thioglycolate, may cause hemorrhaging under skin of hands or scalp, irration, 
headaches, scars on legs, skin bums, and rash. 

10) baby oil (no list): 

• Usually contains mineral oil (non-toxic); 

• Palmitate - no known toxicity to the skin; 

• Lanolin - a common skin sensitizer; 

• Vegetable oils - no known toxicity; 

• Lanolin derivatives - now more often used than straight lanolin (Winter 1989). 

All in all, this appeared to be the least harmful of all the cosmetics in our cupboards. 
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Table 3.5 Ingredients in our sample of cosmetics. (Continued) 

11) Hair spray (no list): 

Hair sprays are reported to cause headaches, hair loss, rash, change in hair color, throat irritation, and 
suspected lung lesions. They are flammable, and at least one hair fire has been reported (associated with 
smoking). Pressurized containers present their own hazards, but not all sprays are so packaged, and the 
sample we found used a pump mechanism. 

12) Shampoo (two different products): 

a. No list — smart marketers! 

b. All the following were in 1 bottle! 

• Sodium laureth sulphate - an amphoteric (+ or - charged) surfactant or wetting agent used as water 
softener. 

• Sodium lauryl sulphate - a detergent, wetting agent and emulsifier that could cause drying and 
irritation of the skin due to its degreasing ability. 

• Cocamidopropyl betaine (coconut oil): good skin cleanser, lathers readily, may cause allergic skin 
rashes. 

• Glycol distearate (to preserve moisture content) - may cause adverse reactions in some users. 

• Cocamide dea or cocamide mea (see coconut oil). 

• Sodium chloride (common table salt) used as an astringent and antiseptic; upon drying water is 
drawn from the skin and may cause irritation. 

• Polyquatemium-7 (surfactant and germicide; member of the quaternary ammonium compound 
family used as preservatives, deodorants, and disinfectants in a wide variety of cosmetics including 
shampoos): Can be toxic depending on dose and concentration. Low concentrations can be irritating to eye 
and mucous membranes. 

• Glycerin (moisturizer): irritating to mucous membranes in concentrated solutions. 

• Soya ethyldimonium ethylsulfate: We were unable to find information on this compound. 

• Methylchloroisothiazolinone: a preservative to replace formaldehyde; not a known sensitizer in 
humans. 

• Methylisothiazolinone: used with the above as a preservative to replace formaldehyde; not a 
known sensitizer in humans. 

• Phosporic acid: an acid, sequestrant (prevents adverse effects of metals in shampoos) and 
antioxidant. No known toxicity in cosmetic use. Irritating to skin in higher concentrations. 

In general, shampoos have given rise to eye irritation, scalp irritation, tangled hair, swelling of hands, face, 
arms, and split and fuzzy hair. They are classed in the "Top 6" of reaction-causing cosmetics by Nater and 
de Groot (1983). 

13) hair conditioner (no list): 

Except for individual allergic reactions, these are considered nontoxic. 

14) face powder (no list): 

Generally include talc, clay and calcium carbonate. Problems are rare ( Winter 1989, pg. 249), but toxicity 
concerns mechanical blocking of skin pores and subsequent irritation. 

15) eye mascara (no list) 

Mascaras are reported to cause itching, burning, swelling of eyes, and eye irritation. Almost any of 
ingredients may cause an allergic reaction in susceptible persons. Nater and de Groot (1983) note that eye 
make-up together has the highest incidence of reports in studies. 


Because of these issues, "hard" data is difficult or impossible to find. Therefore, we will try an order of magnitude 
exercise to provide perspective on the possible size of the risk cost of cosmetics in Canada. 

First, we take a viewpoint that is more or less favourable to the products. Let us suppose that the 15 products listed 
in our sample each cause minor irritation (hazard cost = $50, to be conservative) at a rate of 2 incidents per million 
units sold, which is the lowest rate noted in the studies reported by Nater and de Groot (1983). We will ASSUME 
that all experiences were minor, even though this is NOT the true situation. Let us further assume that a household 
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uses one unit of each of the above products per year, which is likely a low overall rate. Using a rough figure of 10 
million households in Canada, we arrive at the risk cost component (under these specific assumptions) of 

15 *$50* 2E-6 * 10E+6 = $15,000 

Clearly, if the true rate and severity of bad experiences with cosmetic products are as illustrated, we have nothing to 
worry about. 

Conversely, we could take a more cautious view. If we use the US FDA pilot study (Westat report), the incidence of 
severe experiences is reported as 15 per million (Nater and de Groot 1983). We will cost such experiences at 
$25,000 each, since we could find no deaths attributed to cosmetics. We make our damage estimate based on the 
observation that severe experiences often involve the eyes, requiring some hospital treatment, but not necessarily 
long term care, and note that accident insurance benefits for loss of an eye are of this level. The risk cost rises 
dramatically to 

15 * 25000 * 15E-6 * 10E+6 = $56,250,000 
We note that the main reasons for these differences are: 

• The estimate of the cost of the hazard being realized is now much larger; 

• The estimate of the rate of occurrence of these hazards is over 7 times greater. 

While the assumptions on which these calculations are based can be modified, we believe they provide a more or 
less reasonable basis to claim that cosmetics as a product class are not a major source of risk to the population. To 
give a measure of reality to even the higher risk cost above, we see that it is equivalent to a break-even insurance 
premium of under $6 per household, or less than 1% of a typical car insurance premium. 


3.6 Management of Cosmetic Risks 

There are two main aspects of risk management which we wish to consider here: 

• The management of the societal risk, either by the manufacturers, government, or consumer agencies; 

• The choices that users may personally make to minimize risks to themselves. 

Formal measures have been taken by society to manage cosmetic risks only in the present century. While the Pure 
Food and Drag Law was passed in 1906 in the USA, it was not until 1938 that cosmetics were added to food and 
drag law in the US federal Food, Drag and Cosmetic Act (FD&C). In 1960, a colour additives amendment was 
added. Furthermore, an ingredient would have to be "proved safe” before its use as a cosmetic was sanctioned and 
the product marketed. In 1976, the Cosmetic, Toiletry and Fragrance Association of the US set up the Cosmetic 
Ingredients Review project. At the time of writing, measures appear to be forthcoming that will require much more 
detailed labeling of cosmetics in terms of their ingredients. 

Enforcement of these regulations may leave much to be desired. US federal regulations already require a warning on 
the packaging of cosmetics which are untested, but Winter (1989) suggests that to date manufacturers have not 
complied. Moreover, the US federal FD&C Act exempts cosmetics from most of its regulations. The FDA, charged 
with enforcement of the regulations, spends less than 0.5% of its budget on cosmetics (Winter 1989) to try to 
manage the risks of about 20,000 different products, yet there is no (formal) toxicity information for over 50 percent 
of cosmetic ingredients and almost 30 percent have less than minimal information. This does not mean the 
ingredients are necessarily unsafe; they may have been used for many years without observed ill-effects, but no 
experiments have been done to assess how toxic they are. 

Clearly, consumers cannot rely on governmental agencies nor on manufacturers to protect them from cosmetic risks. 
However, consumers have the power to control many of these risks themselves. Moreover, the measures required are 
all simple and rational (Winter 1989): 
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• Read labels carefully and follow instructions. Misuse of cosmetics, like the misuse of any other product, 
may have attendant dangers. 

• To check a product for allergies, test it by applying a small amount on the inside of the forearm, where a 

reaction can be easily seen but largely unnoticeable to others. After 24 hours, the area to which the product was 

applied should be checked for adverse effects such as redness, blisters, or itching. 

• If, after use, a cosmetic causes an adverse reaction, stop using it and do not use it again. In the case where 
several products are being used at once, stop using all of them. 

• If a reaction condition does not clear up, consult a physician. 

• Children and pets should be kept away from cosmetics. 

• Exercise special care with eye make-up. Eye make-up should not be shared since this may spread 

infections. 

• Report adverse effects to the manufacturer, vendor of the product and government health authorities. 

The last point — that negative results of using a product should be reported — is extremely important. A single case 
is unlikely to influence either manufacturers or regulators to modify the product or offer compensation. A dozen 
cases are almost certain to elicit concern, and a hundred are likely to interest public health workers and the media. 
Moreover, most manufacturers want to provide products that satisfy customers. They cannot fix problems about 
which they are uninformed. We do everyone a service by reporting problems with cosmetics as with any other 
products. 

Consumers who know their skin is prone to allergic reactions must take special care with cosmetics. Products 
labeled hypoallergenic are not devoid of common allergens but only less likely to cause a reaction than similar 
products with regular formulations. Another possibility of misunderstanding may arise with products which have no 
fragrance or that are unscented, since these may contain a masking fragrance to conceal unpleasant natural smells of 
the product components. 

Personal management of cosmetic risks may also involve the use of alternatives to conventional products. For 
example, cornstarch may be used instead of talc in some products such as (baby) powders or creams, where it is 
presumed to pose less hazard (Winter 1989). 


3.7 Open Questions 

As societal values evolve, we have seen fashions in personal attire and decoration change over the centuries. Just as 
fur garments may be impolitic to wear in some groups, we believe that it may become unacceptable to use certain 
cosmetic products such as strong perfumes that may bother those in proximity to the wearer. 

There may also be attempts to ban the sale or force changes in the formulation of products that are misused, such as 
after-shave lotion that could be drunk as an intoxicant. 

Already labeling regulations are forcing a change in packaging of cosmetics. Lipsticks, formerly sold in their own 
small cylinders, now often appear in blister packs attached to a card big enough to hold the legend explaining their 
contents. Waste management considerations may force other changes. For example, many cosmetics are packaged in 
very fancy, unique containers that are not reused or recycled easily. Since cosmetics are hardly essential to life or 
critical to psychological well-being, banning those cosmetic products that incur costs on society because of irritants 
of various kinds may be a measure to be debated. 

Finally, while in this case study we have taken the whole of society as equivalent user-stakeholders of cosmetics, 
this is obviously a gross oversimplification. There are, in reality, several partitionings of the human population that 
may be worthwhile from the point of view of identifying particular risks. In particular, we may wish to try to 
identify those risks that especially affect children, who are usually involuntarily exposed to cosmetic risks. 
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4: Irradiated food 


4.1 Background 

4.2 Stakeholders and the risks and benefits they face 

4.3 Risk assessment 

4.4 Management strategies 

4.5 References 

4.6 Further reading 

4.1 Background 

Almost all foods humans consume have been stored for some length of time. This is because the nature of food 
production — agriculture and fisheries primarily — results in the sudden availability of much more food than can be 
consumed immediately. Food that is surplus to immediate needs must be stored until it can be consumed. The 
success of food science over the centuries has largely been measured by how well food can be preserved against 
physical, chemical, bacterial, fungal deterioration and damage by animal pests, primarily insects and rodents. 

Some methods of preservation were known even in Neolithic times — more than 10,000 years ago — and involved 
mainly drying, smoking, or forms of pickling with salt, sugar, brine, or vinegar. In the 19 th century the development 
of canning — essentially the use of heat to kill those microbes that would cause foods to deteriorate with subsequent 
sealing of the contents — allowed far more convenient storage of food. The work of Louis Pasteur to aid the 
vinegar, wine and beer brewing industries gave rise to the heat treatment process which bears his name, though 
today we may associate it more with milk than with beer, vinegar or wine. 

In the early part of the 20 th century, various workers recognized that low temperatures slowed the process of food 
spoilage. This is in part a chemical kinetic effect; reaction rates generally increase exponentially with temperature, 
i.e. a ten degree rise in temperature approximately doubles or triples the reaction rate. (Sienko and Plane 1966, pg. 
227). Also, of course, living organisms may die or be immobilized by cold. The use of refrigeration and the 
development of frozen foods added another dimension to the preservation of food. 

The idea of using ionizing radiation to preserve food was first considered in British patent number 1609, issued in 
1905. However, at this time there were not enough radium preparations available to try it commercially. Spent fuel 
rods were used experimentally as an irradiation source in the 1950s (Diehl 1990). Irradiation was first seriously 
applied shortly after World War II by US army experiments to supply irradiated fresh food for troops in the field 
(Blumenthal 1990). The technology is quite simple. Food materials, generally already packed in sealed bags or 
containers, are exposed to electron beams or gamma rays (Cobalt-60) either in batch or continuous processes. X- 
rays are not suitable for food processing, partly because the process is too expensive. Electron beam irradiation is 
very suitable for grains and uses a batch process. With a Cobalt-60 source, the process can be continuous and the 
equipment design is extremely simple, with most of the moving parts related to the mechanisms for moving the food 
through the irradiation chamber. Generally, there are safety interlocks to shield workers from exposure to the 
radiation source. 

The irradiation dose applied to food materials is usually less than 10 KGy. The Gy or Gray denotes the energy 
imparted by ionizing radiation to matter per unit mass. lGy= 1 joule/kg, 1 rad = .01 Gy. Recommended dosage for 
food irradiation is less than or equal to 10 KGy, which corresponds to the amount of heat required to raise the 
temperature of water by 2.4 degrees C., (WHO/FAO 1988) The purpose of irradiation is to kill any harmful bacteria 
or insects, or in the case of potatoes, to prevent germination, that is, to kill the living organism within the potato 
itself. Irradiation can be similarly used to delay ripening of fruits and to prolong their shelf life. 

Food irradiation has been approved for use in many countries since the 1960s. The products for which it is approved 
vary and many special conditions may apply. We note that many countries permit the irradiation of potatoes and 
onions. Other examples include the following (WHO/FAO 1988): 
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Country 


Food(s) 


Argentina 

Bangladesh 

Belgium 

Brazil 

Bulgaria 

Canada 


some vegetables and fruit 
chicken, fish, shrimp, some local fruits 
strawberries, spices, dried vegetables 

rice, beans, wheat, spices, fish and fish products 
garlic, grain, dry food concentrates, dried fruits 

wheat flour, poultry, some fish fillets, spices 


UK Any food for consumption by patients who require a sterile diet as an essential 

factor in their treatment. 


Former USSR grain, fresh fruits and vegetables, some semi-prepared meat products, dried 

fruits and dried food concentrates. 


US wheat and wheat flour, white potatoes, spices and dried veg, seasonings. 

Effects of irradiation — measured or perceived 

The irradiation of food does alter the nature of the food in certain ways. In doing this, it is rather similar to cooking, 
which is the application of radiation from a different part of the electromagnetic spectrum. Just as cooking changes 
the taste and texture of foods, so also does irradiation. In general, irradiation may soften some fruit. It may also 
produce an undesirable flavour, particularly in dairy products, but this is somewhat dependent on when irradiation 
occurs in the food processing procedure and what dosage is applied. 

What are some changes that are observed? 

Taste: Dairy products irradiated at .1 KGy undergo taste changes in the products which may render them 
unacceptable to consumers. A related situation has been noted in ultra-high temperature (UHT) milk, which has in 
some cases experienced poor consumer acceptance, despite the convenience of long shelf life without refrigeration. 

Meat, especially beef or veal, may exhibit an off-flavor if irradiated at 30KGy but the off-flavour 
disappears during storage and cooking. Lean meat is more susceptible to the flavour change than cuts of 
high fat content. Taste changes can be minimized if the food is processed in a frozen state. 

Colour: Radiation dosages of greater than 1.5 KGy cause some meats to brown on exposure to air. 

Consistency: Some fruits were softened by the irradiation process and a noticeable thinning of soups and gravies 
occurred at irradiation levels of greater than 1 KGy. This may be a desirable occurrence since it would 
reduce cooking time for dry soups and improves the rehydration of dried fruits. 

Nutritional Quality: Some loss of nutrients is involved in all food processing and preparation. Between levels of 10 
to 50 KGy the change in quality was reduced by irradiating at low temperatures and by excluding air. In 
regards to vitamin content, Riboflavin, Niacin and Vitamin D were insensitive to irradiation but Vitamins 
A, B1, E and K were more affected. Proteins were little affected by irradiation. 

It is important to note that irradiation of food does NOT produce radioactive food and no residue is left after the 
treatment, in contrast to the treatment of food with chemicals. Despite demonstrations of the safety and efficacy of 
food irradiation, there remains the perception of risk by some people that has, we believe, hindered the development 
and usage of this technology. As recently as 1992, food processing multinationals such as Heinz, Quaker Oats, 
Ralston Purina, Campbells and McDonalds have shunned the technology (Begley 1992) and irradiated food is 
banned in several states such as Maine, New York and New Jersey (Working Woman 1992). 


4.2 Stakeholders and the risks and benefits they face 


© 1993-97 Nash Information Services Inc, 1975 Bel-Air Dr, Ottawa, K2C 0X1 Canada Copy for archive.org 

Managing Technological Risk: Case Studies and Methods Irradiated food 4-25 




The stakeholders of primary concern in this study are the consumers of irradiated food. The obvious hazard is that 
some (unspecified or unknown) change in food materials caused by the radiation renders the food dangerous in some 
way. Studies performed to date indicate that there is no measurable danger of acute toxicity. A ten year animal 
feeding study (from 1970 to 1980) in which 24 countries participated under the auspices of the Tri-committee, FAO, 
WHO and IAEA, concluded that food was unaffected if irradiated at or below lOKGy. 

The foods tested included wheat flour, potatoes, rice, iced ocean fish, mangoes, spices, dried dates and cocoa 
powder. These foods were chosen on the basis of their importance in international trade, the relevance of these 
products to developing countries and their suitability to irradiation treatment. 

No toxic effects were noted in a French study in which nine chemical compounds in irradiated starch was fed to rats 
in rates as high as 800 times the normal daily intake. Other studies were conducted in which irradiated foods 
composed from 30 to 100% of the diet. It was determined that adverse animal feeding results were due to nutritional 
inadequacy, faulty experimental design or incorrect evaluation of results.( Diehl 1990; WHO/FAO 1988). It has also 
been suggested that the WHO and FAO are in league with the IAEA in order to reduce nuclear waste by utilizing 
cesium 137, recovered from spent nuclear fuel rods, as a radiation source. Industry sources have countered by saying 
that due to economic and other reasons this is not done (Blumenthal 1990). 

While irradiation does not produce acute toxins in food, that is, substances that make us sick soon after we consume 
the food, concern has been expressed that irradiating food causes the formation of radiolytic products. These are 
substances formed as a consequence of irradiating materials. It has been found that at low irradiation doses (less than 
.5 KGy) it is difficult to detect any changes in foods. At high doses (greater than 30 KGy, which is the level 
commonly used for medical sterilization), many chemical changes occur. The substances suggested as radiolytic 
products are, however, not unique to irradiated food. In 1979, the US FDA's Bureau of Foods Irradiated Food 
Committee (BFIFC) estimated that about 90% of substances identified as radiolytic products in irradiated foods 
were also present in non-irradiated foods, including raw, heated or stored food (Blumenthal 1990). 

It is possible, of course, that irradiation produces some carcinogens or other long term toxic materials in the food. 
Consider, by comparison, the controversy over grilled (barbequed) meat. The studies to date, however, indicate that 
irradiation appears to present low risks of this type to consumers. 

Exercise: Find references to nitrosamines and/or polycyclic aromatic hydrocarbons in relation to barbequed food. 
Polycyclic aromatic hydrocarbons (PAHs) are produced when fat drops on hot coals. Smoke from the coals engulfs 
the food and covers the surface with PAHs. These compounds have been associated with an increase in some 
cancers. (Ottawa Citizen, 1993). 

Consumers of irradiated food may benefit from the technology in the following ways: 

• Irradiation eradicates salmonella, which, it is conservatively estimated, is contained in 60% of poultry sold 
in the US (Blumenthal 1990). Irradiating poultry in the US and thus eliminating salmonellosis from contaminated 
poultry was found to have a benefit-cost ratio of between 2.1 and 4.1 (Roberts 1985). 

• Irradiated food needs no refrigeration if the packaging is kept sealed, so that irradiated food may be 
transported easily. This is especially useful to hikers, travellers and others who do not have access to refrigeration. 

• Irradiation of food may preserve it while using less packaging materials or energy than alternatives such as 
refrigeration or canning. 

• For some foods, irradiation may be preferred on the basis of taste or appearance to foods preserved by other 
methods. 

• Irradiation tenderizes beef and reduces rehydration time of dehydrated vegetables. (Krystynak 1986). 

The second major group of stakeholders are the producers and users of the technology. For the nuclear industry, an 
application such as irradiation of food is an important alternative to the traditional markets of cancer treatment units, 
power generation, research and measurement tools and, in some countries, weapons. The stake held is essentially 
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measured by the value of the irradiation units sold. Canada's Nordion International has built more than half of the 
large scale commercial irradiators in use world-wide. In 1990 Nordion made a profit of $16.5 million on revenues of 
$108 million (Prentice 1992). For the users of the units, the stake is measured by the value of the food products 
resulting. 

It is important to note that food irradiation is usually attractive economically only if the quantities of food involved 
are quite large. That is, because the radioactive source is expensive and must be properly shielded, the investment 
can only be recovered by processing a lot of food. The capital cost of setting up a commercial facility is about $ 1 
million for the smallest capacity unit which would be manually loaded using a batch process. For the larger, 
automated, continuous processor, the costs are several million dollars. Unit costs for irradiating various products at 
various volumes, but always in the millions of kilograms, vary from $.06 to $0.26 per kilogram based on a single¬ 
purpose irradiator operating for four months (Krystynak 1986). In a canning process, the cost of the can alone can 
range from $.15 to .89 per can depending on the size needed (Judge 1992). 

Workers have a stake in the technology of food irradiation from the point of view of their jobs and their safety in 
carrying out those jobs. Because of the design of food irradiation units, any job-related dangers are likely to be 
similar to those in any large-scale food processing plant and will involve accidents with loading, unloading and 
moving fairly large packages of commodities with fork-lift and similar equipment. Because the irradiation chambers 
are quite simple in design, there should be no reason for workers to ever be exposed to the radioactive source. 

Societal risks arise in the manufacture and disposal of food irradiation equipment. The radioactive source is 
generally prepared in a nuclear reactor but not of the type used to generate electric power. Such reactors do not have 
the same risks of thermal explosion and melt-down as power reactors because there is much less thermal energy to 
be dissipated. Nevertheless, precautions are needed to avoid release of radiation and radioactive material, and to 
shield workers and others from radiation exposure.. 

Exercise: Can you find references to support the assertions in the last paragraph? 

Similarly, the disposal of the radioactive source must be handled correctly, usually by recycling by the manufacturer. 
There have been serious incidents involving deaths and injuries when radioactive sources have been improperly 
dumped. One such case, in 1987, involved 249 Brazilian individuals who took home chips off a glowing tablet after 
a cancer treatment machine was opened in a junk yard. Forty-four people received serious contamination, 4 died 
and 28 were hospitalized for a considerable period of time (Simons 1987). 

Because perceptions about irradiated food affect its availability and marketability, the media have a special 
stakeholding and role. 

Providing absolute measures for the hazards and benefits of irradiation of food is difficult, since several alternative 
technologies exist. Therefore we will compare to traditional food preservation methods using the main hazard and 
benefit categories. 

Toxic food: Irradiated food appears to present no more and possibly less risk of chemical or microbial toxicity than 
canning, freezing or chemical preservation. 

Worker injury: Apart from the necessity of caution regarding the radioactive source, irradiated food poses no greater 
dangers to workers than other methods. Much of the activity in any food processing operation involves moving 
materials from one processing station to another and packaging the output. Canning and freezing expose workers to 
heat and cold. Canning may present some danger of cuts from the sheet metal used for the cans, though many plants 
have automated canning lines. Chemical treatment of foodstuffs against spoilage or pests presents the hazards 
associated with (usually toxic) chemicals. 

Investment risks: The relatively large plant size and source recycling costs may present a hazard to the operators not 
faced to the same extent by those using canning or freezing. The main issue is that irradiation cannot be carried out 
on a small scale as can other technologies for food processing. 

Unit-cost advantages: When compared to canning, for appropriate foods irradiation has a per-unit advantage. Per 
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unit costs for freezing foods are likely to be lower than those for canning, due to the generally simpler packaging 
(plastic vs. tin can), but freezing imposes considerable ongoing costs for freezers and power. 

Packaging costs: Irradiation is a clear winner over canning and freezing. We need only a package that will keep 
microbial agents out of treated food. 

Environmental issues: The lighter packaging and lower energy input of irradiation favour it compared to canning 
and freezing. Some chemical preserving and disinfestation agents, for example, methyl bromide, have been 
implicated as a major ozone-layer threat. 


4.3 Risk assessment 

We will divide the risks into two categories for analysis: 

• The risk that the food treated is dangerous due to insufficient dose leaving active biological contamination 
or to production of dangerous substances in the food by the irradiation process; 

• The risks due to the manufacture or disposal of the radioactive source. 

Our task is complicated by the fact that there have been only a few large scale applications of food irradiation, in 
part due to negative public perceptions of the technology. 

The risk due to insufficient processing is real, no matter what methods of preservation are used. For comparison 
purposes, it is claimed that in a ten year period the US Center for Disease Control claims that 150 Americans died 
and more than 150,000 were made seriously ill by salmonella contamination of meat (Schneider, K. 1993). 
Irradiation is one method for control of this problem; more careful cooking is another. It must always be 
remembered that irradiation eradicates insects and microorganisms only while the food is exposed to the radioactive 
source. It therefore does not negate the need for careful, hygienic handling of the food throughout all the handling 
and processing steps and after irradiation to prevent re-contamination. 

As we have already indicated, there do not appear to be dangers from induced radioactivity in the irradiated food. 
Nor do the chemical products resulting from the action of the irradiation appear to be toxic to humans. The lack of 
large-scale uses of irradiated food makes it difficult to assess the dangers from long-term exposures, but we may 
anticipate that these are no worse than the risks due to any other form of treatment, and possibly lower than those 
relating to chemical preservatives. 

Because of the simplicity of the methods of food irradiation, the risks of incorrect dosage for the food products are 
quite low. In contrast, in canning it is important to hold the correct temperature for an appropriate period of time and 
for certain foods, to have proper acidity levels. Similarly, chemical preservatives require appropriate doses and also 
careful dispersion of these materials throughout the food. Irradiation only requires exposing the food to the 
radioactive source for an appropriate time period, radioactive material is never added to the food. In a continuous 
processor, this means having the conveyor running at the correct speed. In a batch process, we need only a simple 
timer. When chemicals are being used to disinfest foods (kill insects), as with the use of fumigants such as ethylene 
dibromide (EDB), we have to be careful to remove the treatment chemicals afterwards by ventilation or washing. 

EDB has been banned from use in many countries, including Canada since 1984, but the residue of the chemical 
may still be in the food chain many years after the ban (Immen 1984). Current chemicals used include hydrogen 
phosphide and methyl bromide but these leave residues, cannot penetrate certain commodities, and must be stored 
for a certain period before shipping. Accidental exposure, sometimes with lethal results has occurred (Diehl 1990). 
In 1989, Noling reported that under normal conditions responsible field use of methyl bromide does not present any 
unreasonable human health or environmental risks, though this chemical is now (1997) the subject of a planned 
world-wide ban due to its role in depleting the ozone-layer. 

Exercise: Document the industrial use of methyl bromide and the realization of its environmental impact. 
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For prevention of sprouting in many vegetables, the alternative to irradiation was maleic hydrazide before the 
harvest or propham or chloropropham after the harvest. These were effective and cheap but have now been banned 
in many countries because of residues left on the produce (Diehl 1990). 

The risks due to the manufacture of the food irradiation equipment and in particular the source are quite difficult to 
document. In part, these risks are embedded in the total risk of operating reactors to produce radionucleides for 
medical diagnostic and treatment tools, for industrial measurement equipment used to test castings or welds, and for 
research purposes. The operation of non-power reactors in most jurisdictions is strictly controlled and we have no 
reports of injuries or deaths related to their operation. 

Exercise: Was the 1952 NRX accident at Chalk River (that Jimmy Carter participated in cleaning up) a prototype 
power reactor or mainly used for generating radionucleides? 

When we look at disposal of the source, however, we do have some evidence that there are risks: 

• Brazilian disposal of cancer treatment unit in 1987 

• Mexican steel that was "hot" and distributed in various forms throughout North America in 1984. 

• The Windscale reprocessing plant fire on October 10, 1957 (Brown 1987). 

None of the above can be tied to food irradiation plants, and such facilities would make up a very small percentage 
of the total nuclear disposal problem. This must be cast against the dangers of the disposal of preservative chemicals 
and the by-products of their manufacture. Moreover, as we have indicated, some of these chemicals are simply 
washed or vented to the atmosphere. 

While the actual risks posed by irradiated food may be low, the perceptions of the public are such that there has been 
poor consumer acceptance of the products. This may be perception of wholesalers and retailers rather than their 
customers. As consumers ourselves, we would prefer irradiated food to that treated by chemical preservative or 
disinfestation agents, since the dangers of irradiated products appear better understood and/or lower than the 
alternative chemicals. 

After about 30 years of study of food irradiation by various regulatory agencies, it appears that the principal risk in 
food irradiation is due to nuclear accidents. Irradiated food is probably the most studied food, having been examined 
down to the parts per million level. The risk of contracting salmonellosis from tainted food (which irradiation could 
totally prevent) is far greater. 


4.4 Management strategies 

The main strategy of those wishing to employ food irradiation must be to manage the perception of the risks by the 
public. In so doing, it is quite clear that correct and believable information on the alternatives for food processing 
and their respective advantages and disadvantages must be conveyed to consumers. That is, the fact that food 
irradiation is acceptably “safe” may take a less important role than an understanding of the risks of the alternatives. 

It is likely that the manufacturers of the equipment are not in a good position to promote it. The nuclear industry has 
had serious public relations problems with power plant accidents at Three Mile Island and Chernobyl, the fire at the 
Windscale reprocessing plant, and various complaints about improper waste disposal from weapons plants. By 
contrast, the food industry, and especially organizations that use several alternative technologies to process food, 
may be in a much better position to show how the various processes work, their advantages and disadvantages. Just 
as UHT milk has gradually taken its place alongside regular pasteurized and refrigerated milk — as an alternative 
rather than a replacement — so it is possible that irradiated food could find an appropriate market base from which 
to develop. South Africa has been marketing irradiated fruits and vegetables for many years and all products are 
marked with the Radura symbol, internationally adopted to indicate irradiated food (Krystynak 1986). 

In such promotions, producers are aided by government regulations strictly controlling the handling of the radiation 
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source and its related equipment. These regulations also specify which foods may be irradiated. This is no different 
in nature from regulations relating to canning, refrigeration, or any other food processing activity. In the developed 
world citizens expect governments to take steps to ensure that foods are safe for consumption, and are disappointed 
when such measures fail. Indeed, governments on occasion go to great lengths to act in the perceived public interest, 
as in the case of the supposedly cyanide-poisoned Chilean grapes in 1989. 

We should note that regulation does not attempt to ensure that food is palatable, only that it is safe to consume. 
Consumers, however, may expect products to at least be tolerable in taste. Where standards are difficult to quantify, 
and depend on human judgement, there may be suspicion that governments are siding with business, as in the 
"tainted canned tuna" scandal in Canada in 1985. 

In conclusion, our own opinion is that for selected applications, food irradiation is preferable to alternatives, 
especially some involving chemicals. Public education needs to be greatly enhanced to allow for informed decision¬ 
making by consumers. 
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5.4.4 Strategies for the householder 

5.5 References 

5.6 Further reading 

5.1 Statement of the Situation 

The purity of drinking water has been an issue since the beginning of human society: "And the fish that was in the 
river died: and the river stank: and the Egyptians could not drink of the water of the river" (Exodus, 7, verse 21). 
Drinking water comes from two sources: surface water sources such as lakes and rivers and groundwater sources 
such as underground rock, clay, sand and gravel deposits called aquifers. Aquifers have to be protected from 
contamination because there is no method for cleaning them and the natural cleaning process takes decades (CBC 
1992). 

This chapter will look at the issues of the purity of drinking water from the two types of sources. As well, we will 
consider how additional purification may be applied along with the risks attached to such purifier technology. 

There are three main choices for provision of drinking water: 

• Central purification plants; 

• Private purification apparatus; 

• Bottled drinking water from supposedly pure sources. 

We will use our own city as an example of central purification. In Ottawa, where the domestic water comes from the 
Ottawa river, the first water purification and supply system was approved and built in 1872. This is relatively typical 
of North American cities. During the later part of the 19th century, typhoid was still a problem in most of the world. 
Belgium was the first country to add chlorine to the water supply in 1902 for purification and prevention of typhoid, 
cholera and other water-borne diseases (AWWA 1990). Ottawa added chlorine by 1912; in 1932 the first 
comprehensive treatment plant came on stream at Lemieux island. On a peak day Ottawa uses 545 megalitres of 
water, average per day is 300 megalitres. (1 megalitre = 1 million litres). 

Due to general concern about the quality of drinking water, a whole industry has sprung up to quell people's 
anxieties. In the US in 1993 there were some 400 manufacturers of home water treatment devices and the industry 
was expected to grow to $1B by 1995 (Consumer Reports 1990). In Canada in the late 1970s about 4% of 
households used some type of water purifier (Health and Welfare Canada 1981). Note that "water treatment" and 
"purifiers" are not necessarily the same thing. Water softeners remove the calcium and magnesium which show up as 
deposits on tubs, spots on dishes and scaly deposits on faucets, showerheads, water heaters and water pipes. 
However, their removal does not appear to make water safer to drink. 
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Table 5.1.1 Steps in water treatment 


Intake: large particles, logs, fish or plant material removed as the water is taken into the plant 

Chemical addition: Alum (Aluminum sulphate), polymers and chlorine added to water to remove colour, 

improve odour and taste and aid in particle settlement 

Coagulation: added chemicals cling to undesirable particles in the water. 

Flocculation: formation of large particles (floe) that can be mechanically removed. 

Sedimentation floe settles to the bottom of tanks and is removed from the water. 

Filtration: multilayer filters of anthracite, ocean sand, binding sand and gravel used to remove 

remaining particles from the water. 

Disinfection: chlorine or other disinfectant added (or other anti-microbial measures). 

Aeration: introduction of air to improve flavour. 

Storage: water put in closed tank or reservoir to allow chlorine to disperse through the water. 


5.2 Stakeholders, Risks and Benefits 

Since we all need drinking water to maintain life and health, we are all stakeholders in our concern that the water we 
drink is safe. While many people are worried about the quality of their drinking water, complaints of bad taste or 
strange colour may be based on effects that are actually harmless. For instance in ground water, strange colour, taste 
and odour may often, but NOT always, be due to the presence of ferrous iron, manganese or calcium at levels that 
are non-toxic. We note that the perceptions may be costly, for example, in reducing the sale price of houses in certain 
locations. Also, bad tasting water is sufficiently unpleasant to make us not drink it, thereby obtaining drinking water 
at higher expense from other sources. 

There are, however, dangers of chemical toxicity. About one in six Americans drink water that contains excessive 
lead, which is suspected of being the cause of lowered IQs and reduced attention span in young children. "Soft" 
water can corrode lead water pipes and thereby introduce lead into drinking water. Hidden dangers may exist in the 
form of unknown toxins dumped in the process of hazardous waste disposal. About 10% of the 1.4M underground 
fuel storage tanks in the US are leaking (Caipenter 1991). In Canada the LUST (Leaking Underground Storage 
Tanks) problem is estimated to involve about 20% of the estimated 200,000 tanks in existence. Most of these tanks 
have been in the ground for more than 25 years (CBC 1992). In Canada in 1988 a Federal / Provincial agreement on 
LUST overhaul was signed. Developments since that time include the convening of the National Task Force on 
LUST, resulting in a new code of practice for underground storage systems containing petrochemical products and 
allied petroleum products was published by the Canadian Council of Ministers of the Environment (CCME) in 
March of 1993. Since the signing of the 1988 agreement, many provinces have started to devise and implement their 
own regulations regarding LUST. (Ontario Ministry of the Environment 1993). 

Toxic chemicals may be from natural sources, industrial activity, or household disposal of wastes down the drain. 
Hanford, California, has a problem with naturally occurring arsenic (Carpenter 1991). Closer to home (for us), in 
1991 the Manotick, Ontario, ground water was discovered to be contaminated by a leaking holding tank for a dry 
cleaning fluid, perchloroethylene. It caused users to experience skin tingling, a dry skin feeling even when the skin 
was wet, and dry hair or hair that was falling out. Residents complained that the water looked cloudy and smelled of 
gasoline. The safe level for perchloroethylene is 65 ppB, but here the levels were as high as 70,000 ppB! At those 
levels it is toxic to the liver, kidneys and nervous system. The initial response to this problem was (household) 
filtering of bathwater through carbon and the use of bottled water for drinking (CBC 1992). By the middle of 1993 
affected homes were to be on the regional water supply at a cost to each homeowner of about $2500 (Buchanan 
1993). 

In the ranch country of Alberta contamination by oil company operations has been a major concern. There are 
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reports that cattle may spontaneously abort, have low calf birth weights and die of suspicious causes due to oil spills, 
sour gas chemicals, drilling sludge and flair pits used to burn off waste. The heavy metals and hydrocarbons found 
in contaminating materials are also suspected of causing cancer in animals and humans. Ethyl benzene, zylene and 
toluene have been found in well water (CBC 1992). 

Potentially complicating this issue, especially in some areas such as Alberta, is that the oil industry monitors its own 
ground water. On the other hand, even though claiming the risk to be minimal, Mobile Oil paid $10 million to clean 
up a sour gas plant and Gulf Oil spent $1.5 million over two years to contain contamination in one place in Alberta. 
In general the oil and gas industry is now admitting to contamination due to sour gas plants (CBC 1992). 

The use of chlorine to purify water may result in chloroform, a trihalomethane (THM), being formed by chemical 
reaction with bacterial matter. Chloroform has been seen to cause cancer in rats. The US EPA regulates the use of 
four THMs. Current safe limits for chlorine assume an average consumption of 2 litres of chlorinated water per day 
but suspect chemicals may affect people in other ways by being inhaled (in high concentrations in swimming pools) 
or being absorbed through the skin while showering or bathing. 

Alternative disinfection methods include adding both chlorine and ammonia or treatment with ozone gas and 
hydrogen peroxide. This last treatment method is controversial because it is not known what the byproducts will be. 
Ultraviolet and gamma ray methods of disinfection have been considered (Health and Welfare Canada 1979). 

Nitrates, a component of sewage as well as runoff from feedlots and the use of agricultural and lawn fertilizers, can 
be transformed into nitrosamines, some of which are carcinogenic in rats (Caipenter 1991). They can be removed by 
reverse osmosis systems and distillation systems. Nitrates are most harmful to bottle-fed infants under the age of one 
year. In 1986 a South Dakota infant died after being fed formula made with water from a private well which was 
found to have extraordinarily high levels of nitrate (Carpenter 1991). 

About 8 million people have very high levels of radon in their water supply (Consumer Reports 1990). According to 
officials at the EPA this may cause more cancer deaths than all other drinking water contaminants combined — from 
100 to 1800 deaths per year (Consumer Reports 1990). 

The principal risk of radon is due to inhalation of the gas rather than from ingestion. Another problem is the disposal 
of radionuclides resulting from the accumulation of radioactive radon progeny on the granulated activated carbon 
filters (Rydell et al. 1989). 

While toxic and carcinogenic chemicals are a drinking water concern of the 20th Century in industrialized nations, 
we must remember that water-borne diseases are more likely to cause human death and suffering. Fifteen million 
Americans come down with "beaver fever" every year from drinking water in seemingly clean lakes and streams 
(Eastern Mountain Sports 1992). This is due to Giardia Lamblia, a microscopic organism carried in the feces of 
domestic and wild animals (including beavers). It may cause severe gastroenteritis for several days but symptoms 
could continue for several weeks. 

Approximately 1 in 3 cases of gastrointestinal illness can be blamed on microbes in water. Waterborne illnesses 
appear to be on the rise in the US. Between 1986 and 1988, there were 26,000 recorded cases of waterborne illness. 
In 1987 alone 13,000 fell ill after drinking water contaminated by Cryptosporidium, which is a chlorine resistant 
parasite (Carpenter 1991). 

Clearly it is of importance that we have safe drinking water. However, it is expensive to provide. Bethlehem, NH, a 
town of about 2000 people, has twice turned down a $2 million filtration system even though residents must now 
boil drinking water on occasion. The capital cost of filtration is $1,000 per person (Carpenter 1991). Similarly, North 
Adams, MA, with a population of 17,000 needs a $9.5 million treatment plant (Carpenter 1991). 

Occasional media reports have raised the issue of particulate hazards in drinking water, especially asbestos. 
Amphibole asbestos was not a significant contaminant in Canadian water supplies in the late 1970s and early 1980s. 
Concentrations did not exceed .5 x 10 A 6 fibres/L in any location sampled. Highest concentration of chrysotile fibres 
were found in Baie Verte, Nfld. and Disraeli, Que. The efficacy of removal of fibres from the water supply may 
depend on which stage of the backwash cycle the samples were taken. (Health and Welfare Canada 1979a). The 
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backwash cycle is used to clean the filters. 


5.3 Risk Assessment 

We have already observed that drinking water poses dangers in the form of acutely toxic chemicals and disease- 
causing microbes, as well as long-term hazards in the form of low-level contaminants that may cause cancer, mental 
incapacity, or other health impacts. Our difficulty here is to estimate the probability that individuals in a particular 
situation will suffer the consequences of these hazards. 

There are several particular obstacles to making such estimates: 

• Many of the health impacts of contaminated drinking water may be mis-diagnosed as being due to 
contaminated food or other vehicles of infection or poisoning. 

• The contaminant status of the drinking water actually consumed by someone who becomes sick may be 
unknown. For example, broken pipes may allow contamination of water between the treatment plant and the 
consumer; even treated water is not continuously analyzed for all the possible contaminants. 

• The health impacts of chronic low-level contamination, or even that the presence of low concentrations of 
certain materials may be called contamination, are the subject of controversy. 

What we can consider as a starting point for comparing the risks carried by drinking water is to look at the levels of 
different substances in water. Table 5.3.1 compares regulatory standard maximums with measured levels in treated 
municipal water and published results for bottled drinking waters. 

Table 5.3.1 A partial comparison of water quality. 

Chemical (mg/L) Standard Ottawa River Bottled 




MAC 


(treated) B 

water c 

Actual total dissolved solids 


500 


- 

110-23000 

Cadmium 


0.005 


<0.00005 

0 - .064 

Fluoride 


1.5 


0.99 

0.2-4.0 

Nitrate 


10 


0.186 

0- 17 

Aluminum 


0.1 


0.087 

0-2.4 

Lead 


0.01 


0.0007 est. 

0-0.14 

Nickel 


0.15 


0.00062 est. 

0-0.2 

Sulphate 

500 


21.8 


0-685 

Sodium 

200 


4.6 


3 - 12000 

Calcium 




16.4 

0-320 

Potassium 




0.87 

0.59-245 


MAC - Maximum Acceptable concentrations as published in Ontario Ministry of the Environment, Environment 
Information, Summer 1992, 5 p. 

B - 1991 Water Quality Results of the Regional Municipality of Ottawa-Carleton, Ottawa River and Lemieux Island/ 
Britannia Purification Plants. 

C - Hibler, M. Mineral waters. Canadian consumer, vol. 20, no. 1, March 1990, pg. 15-43. 

What we observe from the table is that municipal water compares favourably with the bottled water. Of course, this 
is municipal water at the treatment plant while the bottled water is presumably as it would be at the point of 


© 1993-97 Nash Information Services Inc, 1975 Bel-Air Dr, Ottawa, K2C 0X1 Canada Copy for archive.org 

Managing Technological Risk: Case Studies and Methods Drinking water 5-4 



consumption. Municipal water can acquire contaminants in the piping system right up to the tap. 


From estimates of the numbers of people who become ill due to water bom diseases, we can at least get some idea of 
the impact of impure drinking water on our society. If we use just the figures for "beaver fever" quoted above of 15 
million Americans per year, we get a rate of 6% of the population of the United States sick each year due to just one 
form of contaminant. Furthermore, this is a type of contamination that can be minimized fairly easily. If we assume 
that of the 15 million cases, one third affect workers, and that each worker loses 2 days of work due to sickness, we 
see that 10 million workdays are lost due to this cause. 

We have also quoted figures estimating that one in six Americans consumes water with excessive lead and that 8 
million have too much radon in the water. The lowered mental capacity from the former and the cancers resulting 
from the latter impose very heavy costs on society. While the estimates of contamination are themselves open to 
criticism, it is yet more difficult to estimate the cost consequences. We shall instead turn to management methods for 
controlling particular risks of drinking water. 


5.4 Management Strategies 

Our management strategy will consist of two steps. First, we must decide on the main approach to drinking water we 
propose to take, that is, to use central purification, local purification or bottled water. A secondary choice will 
involve the particular measures invoked to ensure their reliability and correct functioning. 

In our view, a major part of any management strategy for pure drinking water involves a sound monitoring system, 
since otherwise we cannot measure the effectiveness of any decisions. We have seen that the hazards in drinking 
water, chemical and microbial, are many and varied. Detecting and measuring them is a non-trivial matter. 
Moreover, purification methods tend to be selective in the impurities removed, so that we cannot rely on them as a 
universal solution. To clarify the numbers that may be quoted in the results of water monitoring, we provide some 
perspective in Table 5.4.1. 

Monitoring must take account of a wide range of possible contaminants in water. Because contaminant levels will 
vary over time, we must also monitor frequently unless we purify into reservoirs of known reliability and then 
monitor the water in each reservoir before releasing it to consumers. We know of no examples where such buffering 
of supply is practiced for the purposes of monitoring for safety, but clearly this strategy would be fairly simple to 
adopt, though it would not be without costs. 

Not just any source of water can be considered as suitable as a supply for (local) water purification devices. If feed 
water contains more than 1000 total coliform bacteria per 100 mL or 100 fecal coliform bacteria per 100 mL, it is 
not a good candidate. This is also the criteria used for determining whether a source is good for a municipal water 
source. Higher bacteria rates are unacceptable due to the increased risk of illness in the event of equipment failure or 
other causes (Health and Welfare Canada 1980). 

Table 5.4.1 Contaminant concentrations equivalents 

1 part per million: 1 drop in 10 gallons (40 L.) or a medium fish tank 

1 part per billion: 1 drop in 10,000 gallons (40K L.) or a domestic swimming pool (4m * 5m * 2m) 

1 part per trillion: 1 drop in 10M gallons. (40M L.) or 16 olympic-sized swimming pools (50m * 25m * 2 

m) 


5.4.1 Strategies for municipal plants 
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There are a number of choices that municipal water authorities must make in establishing purification plants. As we 
have seen in Table 5.1.1, there are a number of purification steps. Even at the level of filtration, they may choose 
mesh or sand, activated charcoal, or other materials, or a combination of these. Disinfections may involve several 
chemical or physical methods, and again there are choices of equipment and forms of chemicals to be used. 

An example is the choice of disinfection method. While chlorine is well understood, it does have the potential to 
introduce chloroform into the resulting drinking water. As chlorine is toxic, there is the possibility of poisoning 
workers or adding too much to the water. If flow rates increase, there may be too little added to be effective. By 
using ultraviolet light to destroy microorganisms such as bacteria, fungi, viruses, protozoan cysts or worm eggs, we 
can eliminate such protozoan cysts as Giardia, the cause of 'beaver fever'. UV does not require chemicals and does 
not affect the taste of the water, the equipment needs little maintenance, and varying flow rates within the operating 
range are no problem. There is also no danger of overdose (Health and Welfare Canada 1979). Of course, UV 
equipment requires electrical energy to operate. 

In order to reduce the acidity of the water which could leach out lead in pipes and faucets, public water utilities often 
add lime during the water treatment process (Consumer Reports 1990). They also may add alum as an aid to 
purifying the water, though there are concerns that this may be contributory to Alzheimer's disease (Roemer 1989). 

Because a public utility has a responsibility to many people, it must also decide on a quality management scheme 
involving monitoring and plans for reacting to situations that may arrive. 

5.4.2 Strategies for home purification 

Home purifiers have application to purify feed water from wells or surface sources or as secondary purification of 
municipally supplied water. It is important to realize that different mechanisms may be used and that they have 
particular purposes. 

Home filtration systems using activated carbon and reverse osmosis work to eliminate the hazards from some 
chemicals. 

Carbon filters have been shown to be best at removing pesticide residue and chloroform but have not been found to 
be effective in the removal of lead or nitrates. To be effective, the filter must be of such a size as to be able to hold a 
sizable amount of activated charcoal. Such so-called high volume filters are said to be able to treat up to 1000 
gallons of water. Small, faucet attached filters have been found to be ineffective. In tests carried out by the 
Consumers' Association of the US (January 1990), most filters were not capable of processing much water before 
the filters clogged and flow rate dropped drastically. However, most were still able to remove 90% of the chloroform 
at the end of the test period. The main risk of these filters is that most lose their effectiveness in removing organic 
contaminants long before the reputed lifespan of the filter is over. A sediment filter should be installed in front of the 
carbon filter in order to prolong its usefulness. 

Reverse Osmosis systems work on the principle of a sieve in the form of a semipermeable membrane similar to a 
cellophane like plastic sheet. Pressure in the water line pushes the water against the membrane and lets through 
water and small organic molecules but holds back ions and larger molecules. These systems are effective in 
removing nitrate and lead but are not effective against high levels of hardness chemicals. Because reverse osmosis is 
a slow process, some models run all the time, even when tank is full, thereby wasting water. 

Distillers use the principle of boiling the water and then cooling the steam until the water condenses. Elements that 
do not boil, that is salts, sediments and heavy metals, should stay behind in the pot. Distillers are effective in 
removing lead and nitrate. However, they do not remove volatile organics such as chloroform and benzene which are 
sometimes found in ground water; in fact the distillation process may increase the concentration of these chemicals. 

Distillation is a very slow process. Some designs could splash unboiled water into the collecting jug. Boiling 
chambers may accumulate scale. Unless they are scrupulously cleaned and maintained, some units will start to rust 
and corrode. Distillation involves considerable amounts of energy input, and there are dangers if the boiling 
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chamber boils dry. Thus fail-save mechanisms need to be incorporated and carefully maintained. The unit should 
also have a filter to remove large particles. 


We also note some short term, emergency methods of purifying water. 

Boiling is most effective method of guarding against microbial such as 'beaver fever'. 

Iodine addition is effective against many bacterial and viral contaminants but not against 'beaver fever'. Moreover, 
because of iodine toxicity, it should only be considered for short term use. Excessive levels can cause allergic 
reactions or enlargement of the thyroid gland (Health and Welfare Canada 1980). The daily requirement for iodine is 
.1 -.3 mg/day, depending on the person. Taking the average water consumption to be 2 L per day, the iodine level in 
the water cannot exceed .8 mg/L, if the maximum toxicity level is not to be reached (Health and Welfare Canada 
1980). 

Filtration effectiveness depends on the size of filter pores; it will not be effective against viruses such as hepatitis. 

5.4.3 Strategies for users of bottled water 

In 1986, 1 in 6 Canadian households used filtered or bottled water, spending some $200 million to avoid tap water 
(Walmsley 1990). Bottled water use in the US in 1985 contributed to a $1 billion industry (Gabler 1988). 

Unfortunately, even the best of bottled water products contribute very little to improving our health and may do 
overall harm if we chose the wrong product. Not all bottled waters are alike or of the same type. Still water is any 
bottled water without carbonation. Spring water comes from a natural spring and may be processed or unprocessed. 
It may be naturally carbonated like Perrier, Apollinaris or Radenska, or have carbon dioxide added. Sparkling 
water is water carbonated with carbon dioxide, either naturally or artificially. Mineral water is water that contains a 
certain concentration of dissolved minerals, usually higher than spring water. Bottled water is usually purified by 
ozonation, a process whereby ozone is pumped into it. 

Bottled water is not necessarily more free from risks than tap water. In 1986 the Canadian Consumer ran some tests 
on various waters and found that four out of 15 contained more barium than should naturally occur. Barium is 
harmful to the nervous system, heart and vascular system. Bottled water may lack fluoride and may contain bacteria 
which could lead to food poisoning and serious skin infections (Walmsley 1990). 

In the beginning of 1990 the world experienced the Perrier scare when it was discovered that certain bottles of 
Perrier water contained an average of 15 ppB of benzene, when the FDA limit is 5 ppB. This led to the recall of 160 
million bottles world-wide, costing the company $40 million (Wickens 1990). The contamination was traced to 
faulty cleaning of bottling equipment. 

Out of 18 waters tested in another study, only 4 contained no potentially harmful contaminants at concentrations 
above accepted levels. The other 14 brands had from one to four harmful ingredients each. Harmful substances 
found included cadmium, aluminum, lead, nitrates, fluoride, nickel, sulphate and sodium (Hibler 1990). 

Nevertheless, it is clear that major brand name suppliers of bottled water have a strong interest in providing a safe, 
palatable product, as witnessed by the actions of Perrier. Moreover, their products are monitored by both company 
and consumer agencies, so the consumer has at least some protection from gross contamination. Bottled waters are 
clearly a better choice than untested and/or untreated ground or surface waters. 


5.4.4 Strategies for the householder 

There are some simple measures that the householder may use to minimize the risks of certain hazards. To reduce 
the hazards of lead leaching from pipes, one can use only cold water for cooking and drinking. Letting the tap run 
for about 1 minute at the beginning of each day will flush out lead pipes. This may, of course, be unnecessarily 
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wasteful of water. Letting water sit for a few seconds before drinking or using water which has been stored in the 
refrigerator will allow chlorine to degas. To minimize radon risks, both from water and ground sources the kitchen, 
bathroom, and laundry should be adequately ventilated. Radon can be removed from ground water supplies by air 
stripping. This has been tried in three Northern Eastern US municipal wells and found to a feasible and cost effective 
treatment process (Lenzo 1990). 

Clearly, as with all risk issues, one should take steps to learn of measures in place for purification of municipal water 
supply. We note that our own municipality has open days to show the public how their water is treated. 
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6: Automobile passenger restraint 


6.1 Statement of the Situation 
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6.5 Recommendations 

6.6 Open Questions 

6.7 References 

6.8 Further reading 

6.1 Statement of the Situation 

Automobiles are arguably one of the most important instruments of change in social patterns of the twentieth 
century. They allowed the development of suburbs, shopping malls, drive-in businesses, and a variety of other 
changes in the way we live. They also became the agent of a large number of deaths and injuries. 

As the number of cars on the roads increased, so did the number of traffic accidents resulting in death or injuries to 
drivers and passengers. Concerns about the rates of injury and death prompted interest in ways to minimize the 
damage to humans. In 1949 a patent was issued for a collision mat as passive protection. The first passive seatbelt 
system patent was issued in 1958 and was a system which would accommodate one, two or three passengers in a 
single belt. In the mid-1960s, the first director of the US National Highway Safety Bureau, Dr. William Haddon, Jr. 
felt that automobile accidents were a public health problem of epidemic proportion and advocated passive restraint 
measures as a solution (Johannessen 1987). 

How does a seat belt protect you? Both accident investigation and laboratory crash experiments showed quite clearly 
that one of the principal injury mechanisms was the collision of the passengers with the structure of the car. That is, 
in a collision, the vehicle is accelerated or decelerated while the passenger is not. In a frontal collision, the passenger 
keeps moving until he/she hits the dashboard, windscreen or some other part of the car. In a sideways, rear or roll¬ 
over situation, the passengers encounter side or top panels of the car. A particularly dangerous possibility is that the 
passenger is ejected from the car through a door or window. In 1989 in North Carolina, 13 out of 33 child fatalities 
were due to the unrestrained children being ejected from the vehicle or falling from a moving vehicle (UNC 1990). 

Seatbelts, similar to those in commercial passenger aircraft, were generally offered in automobiles beginning in 
1960s. In Canada, manual seatbelts have been required to be installed since 1971 (Transport Canada 1986). Seat 
belts usage was 15% in 1975 and ten years later, in 1985, 57% of drivers were using them. (Transport Canada 1986). 
By 1986 all provinces in Canada had mandatory seatbelt usage laws except Prince Edward Island and Alberta. 
Seatbelt usage was 78% overall as compared to 60% overall in 1981. Seatbelt usage was highest (88%) in New 
Brunswick and British Columbia and lowest in Prince Edward Island and Aberta, 34% and 45% respectively 
(Transport Canada 1987). 

Special restraint systems for infants and children have also been required in many jurisdictions since small children 
(and pets) were observed to become projectiles in many accidents which they would survive if suitably restrained. 
Between 1970 and 1979 there woidd have been 93% fewer children die if all children were restrained and no 
restrained children ages 0 to 4 died in a traffic accident during the same period. It has been determined that the 
leading cause of death of children and young people from age 1 to 19 is by accidents, poisonings or violence. 
(CCMTA 1982). A restrained child is also less likely to cause distraction for the driver or interfere with safe 
operation of the vehicle since it has been found that 25% of all injuries result from non-crash incidents such as 
sudden stops, swerves, turns or a child's movement within the vehicle (CCMTA 1982). 

Manual seat belts require the user to engage them, so many passengers ignore the belt despite legal requirements. 
This has prompted interest in so called automatic or passive restraints, in particular, air bags. 
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All restraints impose their own risks. Some slow egress from a vehicle, so may be dangerous in the case of fire. 
Passengers can trip over belts exiting from vehicles, particularly in two-door cars. Poorly placed seat belts can cause 
injuries to soft organs in a collision. Air bags have come under suspicion for a variety of injuries, especially if they 
discharge at an inappropriate time or into the face and neck rather than into the chest. 


6.2 Stakeholders — quantifying the hazards and benefits 

The main stakeholders concerned with vehicle passenger restraints should clearly be the passengers themselves. 
However, since some passengers are infants and children below the age of responsibility, this group of stakeholders 
must be divided into two categories, those who are able to decide whether or not to use belts and those under the 
care of others. 

The costs of accident damages are borne not only by passengers but by insurance companies and governments. In 
particular, the costs of health care, disability pensions, survivor benefits and welfare fall on society in general 
through governments. The considerable costs (plus lost tax revenue from formerly productive citizens) is an impetus 
to reducing the road carnage. 

A difficulty in quantifying the damages arises through the "value of a life" issue. Moreover, in some jurisdictions, 
such as Ontario and Quebec, we have "no-fault" insurance schemes that impose limits on the level of damages for 
personal injury and death. The treatment of drivers, passengers in private vehicles, passengers in public vehicles and 
pedestrians may be different under such schemes. We will not attempt to resolve these difficulties here. Instead we 
will attempt to use consistent units of measure when considering parts of the overall management problem. Thus we 
will occasionally use lives lost or saved as the measure of hazard. In others we will be able to put dollar costs on 
hazards. A sometimes useful measure of the efficacy of a risk management initiative is the number of dollars that 
must be expended to save one life. The smaller the expenditure per life, the more effective the measure. 

Automobile manufacturers sometimes use safety as a selling feature (e.g., BMW and Mercedes;Globe & Mail 1993), 
but regulatory requirements force them to incur costs to implement restraint measures in their products. Third party 
manufacturers of, for example, child seats, have a definite interest in the issue. 

The suppliers of the seat belts and air bags and their repair agents clearly benefit from any regulations that require 
use and/or maintenance of the devices. Air bags, if they discharge "accidentally", need recharging as well as 
adjustment or repair of the detector. 

As always, medical personnel, lawyers and the media are stakeholders in the usual way, though since automobiles 
and accidents with them are commonplace, despite their importance statistically, the media appears to be less excited 
about the issue of vehicle restraints than it might be. Medical training may actually be affected by the success of 
injury reduction measures. A close relative complained that the speed limit reductions of the late 1970s and early 
1980s so reduced incidents that medical students were getting insufficient exposure to severe trauma cases. 

When we approach the benefits of automotive technology, the pervasiveness of the automobile in present society, 
precludes their elimination. Automobiles are such a huge part of our economic and social life that we cannot do 
without them. This does not mean that there are not ways to mitigate their negative impacts. In what follows we look 
at ways to limit deaths and injuries due to car accidents. 


6.3 Risk assessment 

The probability that a random automobile passenger is involved in an injury-causing or fatal accident is relatively 
high compared to other perils of living. Such probabilities vary with geographic region and other factors. For 
comparison, in 1981 in the US 24,000 of a total of 120,000, 000 licenced drivers were killed in traffic accidents, 
giving a general chance of death per annum per driver at 24000/120000000 or about 1 in 5000 (Graham and 
Henrion 1984). 
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Exercise: Using fatality and population figures, provide the risk of dying in a car accident in Ontario or a similar 
jurisdiction of interest to you. Try to express the risk as “1 chance in ... per year” and find comparable rates for 
diseases or other risks. It may be interesting to find covariates of risk, such as time or day or week, day or night, or 
driver/passenger effects. 

Risk profiles tell us more about factors which alter the risk of injuries or fatalities. (Canadian Motor Vehicle Traffic 
Accident Statistics 1988, 1989, 1991). We could consider, for example: 

• Time of travel - most dangerous time, around 5 p.m. 

• Driver/passenger - more than 45% of fatalities are drivers vs. about 25 % being passengers. 

• Age of occupants - modal age group was between 25 and 34. 

• Road type (rural, urban, freeway, intersection) - relatively twice as many people killed on rural roads. 

• Role of alcohol or drugs - legal impairment was over 50% in 1981 with a steady decline to about 35% in 
1990 among victims. 

• Vehicle type - since 1978, deaths per registered vehicle have declined in all types of passenger vehicles (US 
Insurance Institute for Highway Safety 1997). 

• Weather - most accidents occurred on clear (sunny or cloudy) days, fewest during conditions of 
fog/mist/smog/dust or smoke. Snow/Freezing rain/Hail/Sleet often associated with the fewest fatal accidents. 

• Whether the driver is wearing a seatbelt - Some research (Transportation Research Board 1989) suggests 
non-users have 35% more accidents than belted drivers. 

A difficulty in interpreting the rates of injury and death concerns the way in which we report these figures. We can, 
for example, express rates: 

• Per person in the population; 

• Per vehicle registered; 

• Per passenger in the population; 

• Per vehicle use or per journey; 

• Per passenger mile. 

The different forms of expression may put an apparently different complexion on the issue of road injuries and 
deaths. Depending on the type of jurisdiction, different methods of analysis and different risk management measures 
may be appropriate. For example, the risk profile for a New York taxi driver and passengers will be very different 
from that of the occupants of a pick-up truck in rural Saskatchewan, and different strategies could apply to manage 
the risks for these various individuals. 


6.4 Management strategies 

The management strategies for vehicle passenger restraints fall into two main categories: 

• Passenger operated restraints (belts, child seats, etc.) with government regulatory and/or use promotion 
campaigns; 

• Passive restraints on passengers such as automatic belts and air bags that do their job automatically. 

Seat belts offer a very simple and robust restraint system. They are relatively cheap ($90 for front seats; Transport 
Canada 1987a) and offer some protection against striking the inside of the vehicle in most types of accidents 
(frontal, rear-end, side or quarter, roll-over). The main technical criticisms are: 
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• Belts may inhibit egress or movement by the passenger to avoid injury, for example, in a case where a car 
goes under the tailgate of a truck. Most such complaints are anecdotal "excuses" by those who do not wish to wear 
the belts. For example, pregnant women should wear seatbelts since automobile accidents are a leading cause of 
non-obstetric death among pregnant women in the US. Despite this, in one study only 4 seatbelt users were noted 
among 115 prenatal patients.(Chang et al. 1985). 

• Lap belts or combination belts where the lap portion is worn too high may cause rib fractures in moderate 
to severe collisions, particularly for elderly occupants. However these are usually not life-threatening and belt- 
induced abdominal injuries are infrequent. (Dalmotas 1986). 

• Poorly adjusted belts (too loose) may be ineffective. Belts which inhibit reaching for needed items such as 
controls, maps, change for road tolls etc., are an encouragement to their non-use. Modem, self-adjusting belts are a 
partial answer to this. Some Ford models have a "Comfort zone" belt which overcomes the annoyance of a constant 
pressure from the belt. There appear to be few cases where automatically adjusting belts have not engaged in an 
accident or sudden braking. 

• Belts may jam or get in the way. This problem has been partially overcome by automatically retracting 
belts, but there are still some annoyances. Some belts are poorly positioned so that they are uncomfortable to wear. 

The annoyances may lead to non-use of the belts. Non-use is the major argument for choosing other measures. 
Consequently, a management strategy that merely requires belts to be provided to passengers may be unsatisfactory. 
It has been determined that without legislation it is impossible to get greater than a 60% usage rate. (Hagenzieker 
1991). Some 40 countries now have laws on compulsory usage of restraints and all Canadian provinces have 
compulsory usage laws. The penalty for non-use is generally a fine. Even with such sanctions, passengers may still 
not "belt up". Ontario uses roadside checks, sometimes combined with drunk driving abatement or other programs to 
monitor seat belt use. It has been noted that in the jurisdiction of Ottawa-Carleton, seatbelt use increased from 
58.3% to 87% after a series of Selective Traffic Enforcement Programs (STEP). There has been a variety of belt-use 
promotional campaigns in many jurisdictions. British road safety experts attribute their 90% seat belt usage rate to a 
12 year public education program on the value of seat belts. (Transport Canada 1986). In Lambton Country, Virginia 
in the late 1980s, if a driver charged with a seatbelt violation agreed to and showed proof of having attended a video 
presentation on seatbelt use, the charge was withdrawn (Callander and DeGurse 1990) As a reflection of these 
efforts, characters in contemporary films and television programs may (sometimes!) be seen fastening seat belts. 

To overcome the need for passenger cooperation, passive restraint measures have been proposed. A number of 
automatic seat belt systems have been tried. These have the disadvantage of requiring relatively complex 
engineering of mechanisms subject to dirt, ice, wear, etc. Since many are powered, there is also the possibility of 
electrical failure disabling them. 

Air bags seem to be winning the popularity battle for passive restraint in the United States. Conceived in the 1940s, 
and researched in the 1950s and 1960s they are unobtrusive and cannot be deliberately defeated. There are clear 
examples of their life-saving capability especially in conjunction with belt systems. For example, between 1988 and 
1994 the number of deaths on US highways dropped nearly 20% thanks to the introduction of air bags and ABS 
brakes (The Ottawa Citizen 1994). However, air bags are more costly than belt systems and have only limited 
effectiveness without belt systems in other than frontal collisions, and even then may be ineffective if the passenger 
is of a size or shape out of the intended norm, or is not sitting squarely in front of the bag. The phenomenon of 
"submarining", where the passenger is forced under the inflating bag may cause injuries as serious as those with no 
bag (Dalmotas 1986). 

The engineering of the air bag trigger mechanism is complex. First, a situation of imminent collision must be 
detected, even if the front of the car is muddy or covered with ice, salt and snow. Once the trigger has been tripped, 
the bag must be inflated within milliseconds and at different rates for large and small cars, depending on the crush 
space. However, in order to allow the driver to maintain control of the vehicle (in the event there is no collision), 
the bag must then deflate again quickly. The bag must also deflate under the load of the passenger to absorb the 
impact. Such inflation/deflation requirements imply that an explosive be used to provide the speedy release of gas. 
The detector, inflation mechanism and bag must be ready to operate reliably over the lifetime of the vehicle, during 
which time it may have to endure extremes of temperature and humidity, vibration and corrosion. 
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Exercise: Find figures on failure rates of air bags. 


As the installed base of air bags increases, a number of reports of injuries attributed to the bags themselves have 
appeared (e.g., Ottawa Citizen 1993). There appears to be an increased likelihood of head and facial injuries in 
frontal collisions at rates below that at which the bag will engage, particularly if the user is not also wearing a 
seatbelt. (Dalmotas 1986). 

Table 6.4.1 gives a comparison of the incremental costs estimated in 1985 (Transport Canada 1986) for automatic 
seatbelts and air bags. We may anticipate somewhat higher values if we were to estimate costs over vehicle lifetime, 
since belts and their mechanisms do need repair and/or adjustment, and air bags occasionally deploy in non¬ 
emergency situations and must be re-installed. We note that the use of seat belts does not prevent the use of air bags 
and that air bags in combination with three-point manual seat belts are considered the most effective restraint system 
by many authors (Ontario 1992). However, we presume the installation of three-point seatbelts to be standard. 


Exercise: Try to find or create estimates of after-installation costs of passenger restraints. 

Table 6.4.1. Incremental costs of passenger restraints (1985 $, based on sales of 1,000,000 units) 
Manual seat belt: $0 


Automatic, non-powered 2 

! or 3 point seatbelt 

$80 

Air Bag (driver only) 

Electronic 

$360 


Mechanical 

$150 

Air Bag (full front) 

Electronic 

$570 


Mechanical 

$400 


The same Transport Canada (1986) study used minimum estimates of $260,000 and $3,000 for each human life 
saved and each passenger injury avoided by passenger restraints to estimate cost effectiveness of different measures. 
This led to conclusions that automatic 2-point seatbelts would only be cost effective if they increased usage rates 
from the 1985 level of 57% to near 100%. The same analysis for 3-point automatic belts suggested that a 30% 
increase in usage (to 87%) would result in a break-even point based on the cost and “value of life” figures. Since the 
same report suggests that up to 33% of Canadians would be tempted to disable these automatic systems, neither 
approach seems worthwhile under the set of estimates used. Nor do such studies show air-bags to be cost effective! 
The reason that we see them in cars is as a result of the political choices made in the United States (Transportation 
Research Board 1989), with Canadian distributors following along. 

The usage of child restraint systems appear to be much less controversial than seat belts or air bags. The main 
concerns seem to be with details of the regulations rather than with the concept. Child restraints vary with the age 
and size of the child and it is now mandatory to restrain infants in all provinces in Canada. Small infants, less than 9 
kgs. or 20 lbs. in weight, should be transported in approved rear-facing infant carriers. These can either be the single 
use models or combination seats which convert into a front facing safety seat when the child is between 9kg or 20 
lbs. and 22 kgs. or 481bs. Beyond 22 kgs. seat belts and booster cushions should be used (Transport Canada 1990). 
In addition, small children should never ride in the front seat of any vehicle under any circumstances. The child 
restraint devices seats appear to be generally well-accepted, even though they impose a burden on parents and others 
who must transport children. To be effective the systems must be properly installed and used, which is not always 
the case. In a survey carried out in 1983 it was found that there was a misuse rate of 75% in either the tethers or belts 
or both (Shelness and Jewett 1983). For effectiveness figures see next paragraph. 

It has been found that after the age of 2, the use of any restraint (belt or seat) reduced from over 70% to less than 
30%. A survey conducted at the Kingston (Ont.) General Hospital determined that car seat usage between home and 
the hospital was 7 to 18% in 1979 but had risen to between 15 and 39% in 1980 (CCMTA 1982). 

The effectiveness of the different measures is clouded by interactions with other measures. Lowered road speeds 
together with high usage of seat belts can have dramatic effects on injury and death rates. In 1976 when the seatbelt 
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law and lower speed limits were enacted in Ontario it was found that the cost of treatment of accident victims 
declined by 10.7% over the next year, resulting in savings of $2 million. The number of hospitalized victims 
decreased by 13.7%, inpatient victims declined by 21.6%, outpatients by 13%. Minor injuries were reduced by 13% 
and moderate to severe injuries by 14.5%. The average treatment cost of belted accident victims was nearly half that 
of unbelted victims (CCMTA 1982). 

We caution again that the way rates are reported may have important influences. Similarly, with a high percentage of 
fatalities involving mis-use of alcohol, programs involving passenger restraint alone are likely to be less effective 
than those combined with measures to eliminate impaired drivers from the roads. In Canada between 1979 and 1988 
at least 40% of fatally injured drivers were legally impaired (>80mg%), with a high of over 50% in 1981. The rate 
had dropped below 40% by 1989 and subsequent years (Transport Canada 1988, 1989, 1991). 

It is also clear that the political culture of the jurisdiction is important in the successful outcome of passenger 
restraint initiatives. In Canada (Transport Canada 1986), the additional savings in life and injuries avoided do not 
offset the cost estimated for air bag introduction. Moreover, these claims were based on an assumed 57% usage rate 
for seatbelts, while usage rates appear to have increased rapidly to 78% by 1986 (Transport Canada 1987). 
Furthermore, the conclusion does not take account of the costs of injuries due to air bags, nor the likely drop in seat- 
belt usage as passengers start to rely on the passive "protection". 


6.5 Recommendations 

Personally, we have difficulty accepting air bags as a suitable response to the passenger restraint problem, given the 
limited effectiveness and high cost. Furthermore, our experience with automatic belts has been an unhappy one; both 
authors are short, and the motorized automatic belts we experienced in rental cars threatened us with strangulation or 
twisted spectacle frames. 

Newspaper articles in the 1996-97 time period have raised the issue of injuries to smaller passengers and drivers 
from unnecessary air bag inflation. We have followed suggestions to move the passenger seat as far from the air bag 
as possible and to lower adjustable steering wheels (where air bags are installed) to the lowest possible setting. We 
would be happier, however, to be able to selectively disable air bags. Such disabling raises awkward design, 
management and public policy issues. If they are to be armed by a switch, it would be as well that this be done on a 
per-trip basis, at the time of ignition. It should also be made very difficult to allow the impression that air bags are 
active when they are not. Emergency service personnel should be able to de-activate air-bags. There are concerns of 
serious injury to rescuers leaning into a vehicle to help victims of a crash (General Motors 1990). Clearly more 
analysis of the overall risk and benefit of air bags is desirable. 


6.6 Open questions 

While we have examined passenger restraints, such devices have an effect that can be magnified if combined with 
other safety features, such as energy-absorbing frames and furnishings. We believe that more research on such 
interactions would be fruitful. Similarly, the success of advertising campaigns on seat-belt usage may indicate that 
expenditure on attitude adjustment is more cost-effective than that on technical devices. 

Most of the literature on seatbelts deals with either 2-point or 3-point anchoring. We are not aware of any studies of 
the use of the more symmetric and restrictive belts used by aircraft pilots and racing-car drivers. Nevertheless, every 
racing season of Indy-cars or Formula 1 offers spectacular crashes where drivers walk away with little or no injury. 
Whether such restraints would be effective for general use, and whether they could be designed so that they were not 
inconvenient are clearly matters for additional study. 
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7.1 Statement of the situation 

This chapter looks at the risks accompanying the technology of video display terminals. We will take a broad view 
of such devices, that is, we will consider the term Video Display Terminal (VDT) to encompass any device that uses 
a screen to display information, and furthermore consider any equipment, wires, furniture or other accoutrements 
that accompany the screen display. Thus we consider keyboards for input part of the VDT. Other authors may be 
more selective in their treatment of the subject. Video games employ the same technology. It is not clear if cash 
registers and supermarket checkout stands are considered VDTs by most authors, even though they use the same 
technology. 

We will consider the technology from approximately the mid 1960s to date. Its importance expanded during the 
1970s as time-shared computer systems became popular. The appearance of personal computers caused a very large 
increase in numbers of VDTs. Estimates of the numbers of VDTs vary. In 1987 it was estimated by the US Centre 
for Office Technology (Council on Scientific Affairs 1987) that there were over 15 million VDTs in use in the US, 
and the Council predicted 70 million by 1990 and 100 million in use by the year 2000. The Council further 
estimated that about 50% of the 15 million VDTs were operated on a part-time or full-time basis by women in their 
childbearing years. The National Institute of Occupational Safety and Health (NiOSH ) predicted in 1989 that there 
would be 40 million VDTs (in the US) by 2000 (Emurian 1989). Brodeur (1990) suggested that there were 40M 
VDTs in use in the workplace, while Blackwell and Chang (1988) stated that there were 10 million VDTs in use in 
the US and 1.5 million in the UK. None of these figures appear to include all personal computers, most of which we 
would assert are used for work, nor are video games included, of which many millions have been sold and are 
frequently heavily used. 

The first studies of VDT hazards were carried out in Sweden in the early 1970s, and were chiefly concerned with 
eyestrain and other ocular effects. Eye problems are still the most common complaint of users of VDTs. Later 
possible radiation hazards became a cause for concern. 

VDTs work on the principle of cathode ray tube displays which draw images on a screen with an electron beam that 
excites phosphors to glow. Ionizing radiation, in particular low energy X-rays, can be produced when the electron 
beam strikes the VDT screen. However, it has been found since the 1960s that the lead oxide glass used in VDT 
screens reduces the already small X-ray leakage to negligible levels (Blackwell and Chang 1988). 

Ultra-violet (UV), visible and infra-red (IR) radiation are also produced as the electron beam strikes the phosphor on 
the inner surface of the screen. The visible radiation is desirable — it gives us the screen image. UV radiation can 
cause eye-damage or "sunburn", but the radiation level from VDTs is usually too low to be detectable in the far (or 
dangerous) part of the spectral range. 

Very and Extra Low Frequency radiation (VLF and ELF) are produced by horizontal deflection and high-voltage 
(fly-back transformer) circuitry. In other equipment, such as personal computers, fans and wires may give off 
electromagnetic radiation, though it appears that microwaves are probably not present (Blackwell and Chang 1988). 
Even early radiation surveys (Ruzek 1983) showed that all types of radiation (X-ray and non-ionizing) were below 
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occupational exposure standards and in many tests the level was lower than what the measuring instruments could 
detect. Even tests conducted in "worst case" conditions showed radiation levels well below accepted standards. 
Household appliances may have higher emissions (Blackwell and Chang 1988). 

Other studies have looked at the ways in which VDTs are used i.e., the ergonomics and work standards. In addition 
to eyestrain issues, concerns about posture and about the possibility of repetitive strain injury (RSI) have become 
more prominent. Stress induced by the nature and pace of work forced by computer systems has also been 
mentioned ( Arndt 1983). 

In our own consideration of the issues, we have wondered about the possibility of chemical hazards. New computer 
equipment can, in our experience, give off an unpleasant smell with the heat of operation. We also wonder about the 
possibility of RSI from video games, whose controls are so vigorously and repeatedly used by avid players. 
Recently, (Hugill 1993) warnings were issued by Nintendo and Sega regarding the potential for video games to 
induce epileptic seizures. 

As part of the background to the VDT subject, we may consider some worker complaints to be generated as a 
reaction to unwelcome changes in work conditions. Workers may perceive health complaints as the only legitimate 
reason to reject the technology (Damodaran 1984). 

Clearly, VDT technology has not been rejected but has become ever more pervasive. Few of us could afford to 
return to typewriters, manual reservation of airline flights, and so forth. 


7.2 Stakeholders and the risks/benefits they face 

Workers are the main stakeholders facing hazards from VDTs. Both clerical and professional workers are heavy 
users of VDTs. We personally find most of our working day spent in front of computers rather than at the traditional 
desk. There may, however, be differences in manner of use of VDTs. 

Employers are also stakeholders. VDT technology gives benefits which few could afford to give up. Prohibitions on 
assignment of certain employees to use VDTs could be costly for employers since there may be few positions which 
do not require some use of a VDT in many modem organizations. 

Workers and employers together are users because the technology does give them benefits in terms of productivity 
over other information management and processing technologies. Players of video games are beneficiaries of an 
entertainment that did not exist before VDTs. Labour unions are stakeholders in so far as perceived or actual hazards 
are grieved by workers. VDT manufacturers and distributors, along with video game purveyors, have a clear interest 
in the continued and unrestricted use of VDTs. Given the fears about miscarriages and concerns that radiation (even 
non-ionizing) may cause genetic damage, we may put future generations as stakeholders. 

Throughout the history of safety studies of VDTs there have been suggestions that the technology was a cause of 
birth disorders and spontaneous abortions in female workers. To date, all studies have failed to establish a causal link 
between these disorders and radiation. In fact, VDTs are said to be less of a hazard to the human fetus than 
diagnostic ultrasound (Council on Scientific Affairs 1987). 

As with most of the cases in this book, we have the usual societal stakeholders, namely the medical profession to 
diagnose and treat injuries (or perceived injuries), political and regulatory bodies as representatives of society, and 
the media as agents of information or misinformation. 

7.2.1 Quantifying the hazard 

VDTs have been blamed for everything from a bad taste in the mouth (VDT News 1990), menstrual complaints 
(VDT News 1990a) corroded tooth fillings (VDT News S/O 1990), high pitched noise (VDT News S/O 1990a) to 
miscarriages and birth defects (See list of recent studies and findings, VDT News May/June 1991, pg. 6). Since it 
has generally been concluded in studies to date that VDTs are NOT the cause of such problems, no real hazard costs 
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are attributable. We could, however, ascribe a cost to the nuisance and lost productivity from the complaints and 
their handling. Certainly the large number of column-inches of newspaper and magazine coverage alone implies a 
considerable expenditure of money for investigating, reporting, publishing, and even reading about the issue. 

How and under what conditions VDTs are used may pose hazards. Ergonomic problems of eye irritation, headaches 
and general stress are due to glare, improper lighting, improperly corrected vision and poor arrangement of work 
materials. The major costs of such "hazards" are likely to be in lost productivity. Such losses are difficult to quantify 
with any precision, but we may partially infer their magnitude from expenditures on furniture, equipment, 
accessories and consultant studies on ergonomic work environments for VDT users. The Los Angeles Times spent 
$1.5 million on ergonomic workstations and accessories (VDT News 1991). This is less than they spent on 
compensation for RSI injury claims. 

Exercise: Find other figures for expenditure on ergonomics for VDT workstations. 

Up to 1993, it appears that RSI injury claims were the only ones that have been compensated. A sum of $2.2 million 
was allocated by the Los Angeles Times for compensating the 443 RSI claims filed by 1991. (VDT News 1991). The 
figure per claim, approximately $50,000, seems to accord with other information available. Unfortunately, by 
imposing non-disclosure clauses in settlements, lawyers are getting in the way of information (VDT News 
July/August 1992, pg. 9) as well as reaping a healthy portion of the settlement for their fee. 

In the absence of costs of treatment and of work loss of typical RSI cases, or similar worker compensation or 
disability insurance figures, we may try to infer a typical cost from salary rates and likely loss of capability. For 
example, a typical administrative worker may perform more than 20 hours per week of VDT work, and a worker 
salary of $20, 000 per year in 1990 dollars could be supposed. Since RSI-injured workers are not fully disabled and 
there is some expectation of at least partial recovery, for instance, to do general clerical functions other than full¬ 
time keyboarding, we might expect 2-3 years salary as a settlement. This seems consistent with reported figures. 

Other hazards which VDTs have been accused of causing have so far been either unsupported by evidence or 
considered to be of insignificant cost. We mention some under Risk Assessment. 

7.2.2 Quantifying the benefits 

The benefits of VDT technology are most easily quantified for individual applications. Consider, for example, the 
production of this book. Before VDT technology, as in the production of our book Compact Numerical Methods for 
Computers (Nash 1979), the manuscript was typed on an electro-mechanical typewriter. Figures were added by 
manual drawings or by cut-and-paste of computer listings. The material was re-keyboarded by the typesetters, with 
equations set manually. Galley proofs were sent back to us for correction. The pages were then laid out, and editors 
once again verified the material. 

For a similar book (Scientific Problem Solving with PCs, Nash and Nash 1993), we entered outline points and 
research notes into a PC word processing program, generally ignoring format and layout. The notes were then 
moved and modified to give draft chapters. More research followed to clean up technical loose ends. The chapters 
were then roughly formatted, figures and tables added, and a trial printout made. When all the chapters were ready, a 
full edit was carried out to tidy the layout. The submission "manuscript" was produced, reviewed by the editors, and 
corrections made. The results were "printed" to disk files in PostScript, a page layout language that typesetting 
machinery can use directly. All figures are present in the disk files, reducing the opportunity for mistakes in layout. 

The down-side of this is felt in the printing and publishing industry where typesetters, editors, and ancillary 
personnel have lost employment. From the perspective of the author and editor, there is also a change in the nature 
of the work, namely less proof-reading for typesetters’ errors, more layout and design effort. Generally there is less 
of the monotonous text entry and more technical or creative work. 
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The removal of the re-keyboarding provides the most obvious measure of direct cost savings here. At $20 per page 
(a fairly conservative figure for typesetting of mathematical and technical material) on a 250 page book, we get a 
$5000 saving. Thus, in just one project we recover an amount that is similar in magnitude to the cost of a personal 
computer and a high quality printer (i.e., the VDT equipment). 


7.3 Risk assessment — probabilities of occurrence 

Figures for the incidence of problems with VDTs are not easily obtained. Only vigorously pursued complaints are 
registered in media or investigative reports. The grumbling at the water-cooler, while indicative of dissatisfaction, 
do not provide measures of the incidence of realization of hazards. 

Since RSI is the most quantifiable hazard, we need to know its incidence. It is relatively common and 290,000 cases 
were reported to the US Dept, of Labour in 1989, up seven- fold since 1981 (Baker B 1991). However, RSI can be 
caused by actions other than working at a wordprocessor or terminal. Nevertheless, Rosch (1991) reports that 56% 
of keyboard operators have symptoms of keyboard-caused injury, 8 % so serious as to require medical attention. 
Sometimes Carpal tunnel syndrome (CTS) - a nervous condition resulting from repetitive hand and wrist motion, is 
confused (Sandmaier 1990) with less serious disorders such as tendinitis or RSI, which can be solved by adjusting 
the chair and/or desk height, foam wrist rests, and taking exercise breaks at regular intervals. In Ontario the number 
of billings due to CTS billed to the Ontario Health Insurance Plan (OHIP) rose steadily in the 1980s from just under 
3,000 in 1980 to nearly 11,000 in 1989 (Liss, G. M. et al). It has been found that older, more experienced workers 
are less likely to suffer RSI problems than their younger, less experienced colleagues (Morgenstem et al. 1991). 
However, it is not trivial to get a good estimate of the numbers of people affected nor their age distribution because 
the number of keyboard operators is not given. We can obtain approximations from the estimates of the numbers of 
VDTs, but must recognize that many users cannot be classed as keyboard operators because their level of use is low. 
On the other hand, we may underestimate the total situation since video games may be omitted. 

The existence, let alone the probability of realization, of other hazards with VDTs is disputed. We will deal with 
several of these in turn. 

Noise in the form of sound waves from cooling fans and impact printers is considered to be irritating but not 
harmful. Pulsed VLF (Very Low Frequency) sound coming from an unshielded fly-back transformer at an intensity 
of between 79 and 150dB could cause temporary hearing loss, fatigue, headache and tinnitus. However, because the 
highest recorded intensity is 68dB (Council on Scientific Affairs 1987) this is not considered a problem. By contrast, 
Tennent (1971) puts the noise of a loud conversation at 70 dB. 

Council on Scientific Affairs (1987) and Rosner and Belkin (1989) were unable to conclude that there was any risk 
of eye cataracts or other organic eye damage from VDT use. This does not imply that there are not other eye 
disorders generally resulting from muscle fatigue. Similar concerns arise with excessive reading or close visual 
work. 

Skin rashes, possibly as a result of the electrostatic charge that can accumulate on a screen, have been reported 
(Council on Scientific Affairs 1987). These complaints were eliminated by an adjustment in the relative humidity 
and ventilation of the workplace. 

Reproductive hazards have not been substantiated. In some studies no statistically significant results were found; in 
others, birth defects were non-specific defects considered heritable. Yet other efforts were flawed in some way 
(Council on Scientific Affairs 1987). Studies exposing incubating chicken eggs to ELF radiation of various strengths 
showed a lack of morphogenesis, which is the differentiation of cells and tissues in the early embryo to establish the 
form and structure of various organs and parts of the body (Stedman 1990). The studies have not been successfully 
replicated and therefore extrapolation to humans is doubtful. 

VDTs emit some types of radiation similar (except for wave form) to that received from common household 
appliances, such as kettles, hairdriers and irons. However, the level of radiation of VDTs is lower than that of 
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diagnostic ultrasound (Council on Scientific Affairs 1987). In 1988 Blackwell and Chang concluded that it is 
reasonable that a pregnancy will not be harmed by using a VDT. 

Data on miscarriages sometimes show clusters of occurrences that may possibly be linked to VDT use. A well- 
documented example (Blackwell and Chang 1988) is that of the Dallas Sears-Roebuck cluster where “of 75 workers 
in one department using VDTs, 12 became pregnant, seven of these pregnancies ended in miscarriage and there was 
one neonatal death, a rate of 67%. A control group of 59 workers not using VDTs showed a 15% failure rate (P < 
0.0006).” 

While the disparity between the rates is stark, Blackwell and Chang point out that the very large numbers of offices 
with women of childbearing age using VDTs implies that we can estimate that there would be 29 such clusters of 
differential rates throughout the world in the same time period. This does not mean that we should ignore the 
miscarriage clusters, but it does make it difficult to state that they “prove” there is a problem with VDTs in relation 
to pregnancy. 

Nevertheless, such clusters give rise to perceptions of risks, particularly if there is dissatisfaction with pay or 
working conditions. As Rosch (1991) points out, results may be taken out of context; he points to a Kaiser 
Permanente study intended to investigate the impact of insecticides on early pregnancies that serendipitously 
indicated a higher risk of miscarriage for women using VDTs more than 20 hours per week, but suggested that this 
was not due to VDTs but to associated stress or working conditions. 

Flowing from perceptions of risks, and possibly augmented by physical fatigue and eyestrain, are psychological 
factors such as annoyance, anxiety, depression, anger, and confusion. These are likely due to the nature of the work, 
work load, work pace and the working environment rather than the VDT technology (Ruzek 1983; Grandjean 1987). 
Worker attitudes, compounded by a fear of technology, may be the driving force here. 

With “attractive” activities, such as the technologically identical video-games and video-lottery terminals, 
complaints have been slower arising. Nevertheless, recent (1992/3) concern has been noted that the movement and 
flicker of video-game images may have triggered (possibly fatal) epileptic seizures in susceptible individuals. Risk 
factors suggested are long duration of play especially by menstruating female adolescents (Hugill 1993) 

We did not find concerns about chemical hazards, even though our own experience is that new VDT monitors 
"stink" when turned on for the first few weeks. The chemicals in use are likely to be similar to those in other 
manufactured products and present in modem buildings e.g. carbon monoxide, formaldehyde, hydrocarbons, acetic 
acid and ozone. Ruzek (1983) found ambient levels from VDTs all to be below federal limits for occupational 
exposure. Similarly, electric shock hazards appear minimal despite the high voltages employed, particularly in 
colour monitors. 


7.4 Management strategies 

Given public awareness of VDTs and their supposed "risks", any approaches to risk management must include 
consideration of perceptions. Since there appear to be no physical hazards except those related to RSI and fatigue, 
any approach will first have to address working style and environment. Noise can be reduced by component 
shielding, particularly of impact printers. Noisy fans should be replaced. Proper adjustment of humidity and 
ventilation of the work space will avoid static build-up believed responsible for skin rashes (Council on Scientific 
Affairs 1987). 

Eye problems can be minimized by ensuring appropriate lighting and adjustment of VDT screens. This is still a 
problem in some work environments that should be more enlightened. Coyle (1993) notes that the Workmen's 
Compensation Board (WCB) building in Toronto suffered "lighting deficiencies (that) apparently lead to headaches 
and eyestrain for VDT users." Pre-placement testing of employees to ensure they have appropriate corrective lens 
prescriptions can avoid some complaints of eye fatigue. Periodic reexamination of eyes is recommended. Well- 
designed furniture, lighting and glare reduction also eliminate most problems of neck, shoulder, back and wrist pain. 
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Allowing — or even forcing — users to take breaks can reduce stress that can lead to organic, psychosomatic and 
nervous disorders. Ruzek (1983) recommends 15 minutes every hour for very intensive work and a similar break 
every two hours for less intensive work. Here the nature of the task may be at fault, not the VDT. That is, the VDT is 
just the representative of an overall system that is not user friendly. Video games or Video Lottery Terminals are 
seemingly attractive enough that users will not take breaks, nor operate them in ergonomically sensible ways. 

Particular measures can be taken to address most of the hazards mentioned. 

Office furniture 

The chair and work table should adjust to the height of the user. The chair should be such that the user's 
hips and knees form right angles and the feet are flat on the floor. Wrist rests — foam padding on the edge 
of work table — can help wrists remain straight, to prevent carpal tunnel syndrome (CTS). The mid-row of 
the keyboard should be below elbow level. 

Screens and lighting 

A glare filtered screen will reduce glare thus cutting down on eyestrain and back and shoulder pain 
(Working Woman, March 1990, pg. 52, Nov. 1990, pg. 148). The screen should be positioned to take 
advantage of any available natural light. Light should not be directly above the screen. The top of the 
screen should be just below eye level. (We have seen a variety of other choices.) We desire the proper 
lighting for the type of work done and the environment in which it is done. Reduce glare by positioning 
workstations properly. 

Unfortunately, the use of add-on antiglare screens may in fact contribute to eye fatigue by reducing image 
sharpness. (We do not use them ourselves, but one of our most pleasant screens had a built-in black silk 
surface on the screen.) A tiltable, flat monitor screen is also recommended to reduce glare. Regular cleaning 
of screens also helps (Rosch W L 1991). 


Distance 

To reduce any radiation effects, time in front of the VDT should be shortened. Sit at least an arm's length 
away from the front of screens, and at least 4 feet away from any other VDTs in the work area. Note that 
more radiation may be received from the back or side of a CRT monitor. This may imply that arrangements 
of VDTs in rows as in stock or commodity trading offices may be a bad idea. Turn off screens when not in 
use. Screen blankers do not really help since monitor emissions are not greatly affected by brightness. Low 
emission (VLF) screens are now offered by most major computer manufacturers (Rosch 1991a). 

Alternative technologies 

It may also be worthwhile exploring alternative technologies. Liquid Crystal Displays (LCDs) do not have 
flyback transformers nor electron guns. They may, of course, have other, as yet unforeseen hazards, but 
they are certainly quieter, smaller and cooler than CRT displays. While there were visibility problems with 
LCDs, these are rapidly disappearing, at least for single user VDTs. 

Some of the problems of RSI and fatigue may disappear as different input technologies are developed such 
as handwritten input, voice recognition, optical scanning etc. Many decades of typewriter use produced 
fewer concerns than just one decade of VDTs, probably because typewriters demanded that the worker load 
and remove paper, and move hands from the keyboard to correct errors. The work style was different. 
Moreover, the worker drove the typewriter, but computers drive VDTs, with the worker along as an 
unwilling passenger. 

Human resources policies 

The perceptions of risks with VDTs are, as illustrated by video games, a function of their use being 
voluntary. Thus it makes sense for managers to empower workers to control their own workspace and pace 
as far as possible. Management encouragement of attention to ergonomics, to proper work habits, and to 
immediate fixing of problems will at least minimize the temptation to turn VDTs into a worker- 
management issue. 
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7.5 Recommendations 


From the point of view of dollar-cost risks, it is clear that managers must avoid worker RSI claims. This implies 
ensuring a working environment and style that permits proper posture and comfort while working, minimizes stress 
while maintaining productivity, and ensures suitable rests or changes of activity. 

From the point of view of perceptions, managers should make clear that their organizations are knowledgeable and 
prepared to use VDT technology responsibly. Occupational health professionals can be used to educate workers and 
employers to assess health problems. 

Health care professionals should take steps to educate themselves to occupationally related health issues so that they 
can recognize these problems. 


7.6 Open questions and topics for further study 

It remains to be seen if the VDT issue is one that will grow or one that will be a short-lived fashion. New forms of 
VDTs based on LCD screens on which the user writes with a stylus or selects menu items may eliminate many of the 
problems associated with large monitors and keyboards. The issue of computers controlling workers rather than the 
other way around will remain, though this is already under attack as undesirable for long-term progress. 
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